IIoT Chip Maker Advantech Hit By Ransomware, $12.5 Million Ransom

The Conti ransomware gang hit the systems of industrial automation and Industrial IoT (IIoT) chip maker Advantech and is now demanding a $14 million ransom to decrypt affected systems and to stop leaking stolen company data.

Advantech is a global leading manufacturer of IT products and solutions, including embedded PCs, network devices, IoT, servers, and healthcare solutions, with a workforce of over 8,000 people in 92 major cities around the world.

The company was the world industrial computing leader with a 34% WW Market Share in 2018 and it reported a yearly sales revenue of over $1.7 billion in 2019.

Ransom set at 750 Bitcoins

The Conti operators behind the attack on Advantech’s network have set a ransom of 750 BTC (roughly $12,600,000 at today’s exchange rate) for full data decryption and for removing stolen data from their servers according to a chat log seen by BleepingComputer.

Conti also said that they are willing to decrypt two of the encrypted files before the ransom is paid as proof that their decryptor works.

The ransomware operators added on November 21, 2020, that they will leak part of the stolen data if there was no reply from the company within the next day.

Also Read: Key PDPA Amendments 2019/2020 You Should Know

On November 26, the group began publishing Advantech’s data on their ransomware data leak site as a 3.03GB archive with 2% of the stolen data and a text document with a list of files included in the ZIP archive.

The ransomware gang also stated that if the ransom is paid they will immediately remove any backdoors deployed on the company’s network and will provide security tips on how to secure the network to block future breaches.

They also said that any stolen data would be deleted once the payment goes through. Despite their promises, research by ransomware negotiation firm Coveware has shown that some ransomware operations don’t actually remove deleted files after a ransom payment is made.

While the company has not issued any public statements regarding the ransomware attack on its systems, BleepingComputer was able to obtain a copy of the ransom note the Conti operators deployed on Advantech’s encrypted sytems.

An Advantech spokesperson was not immediately available for comment when BleepingComputer reached out earlier today.

The Conti ransomware

Conti ransomware was first spotted in isolated attacks at the end of December 2019, with attacks picking up in June 2020.

This ransomware shares code with the notorious Ryuk Ransomware and began being distributed through reverse shells opened by the TrickBot trojan after Ryuk activity dwindled down in July 2020.

Conti operators breach corporate networks and spread laterally until they gain access to domain admin credentials that allow them to deploy the ransomware payloads used to encrypt devices.

Also Read: The 5 Benefits Of Outsourcing Data Protection

Operating as a private Ransomware-as-a-Service (RaaS) that recruits experienced hackers to deploy the ransomware in exchange for large ransom shares, Conti opened their own data leak site with twenty-six victims in August 2020.