Pitney Bowes hit by Maze in second ransomware attack in a year

The cyber criminal team powering the more and more harmful Maze ransomware strain promises it has effectively encrypted methods at mailing and shipping services agency Pitney Bowes, much less than a calendar year after it was hit by a similar assault.

The group guiding Maze, which specialises in double extortion, a variety of assault that increases force on its victims to pay out by threatening to launch important knowledge in addition to encrypting systems, confirmed the attack on Pitney Bowes in a launch posted to its website.

A Pitney Bowes spokesperson claimed: “Recently, we detected a security incident associated to Maze ransomware. We are investigating the scope of the assault, especially the sort of knowledge that had been accessed, which seems to be limited.

“Working with our 3rd-get together safety consultants, we immediately took critical measures to thwart the assault ahead of data could be encrypted. At this position, there is no evidence of more unauthorised obtain to our IT systems. The investigation continues to be ongoing.”

Screenshots posted by Maze counsel that the team has stolen knowledge on a range of Pitney Bowes buyers, together with main insurance policies companies and stores, as well as details and details relating to the company’s internal procedures, these kinds of as management and teaching insurance policies.

The Oct 2019 assault on Pitney Bowes encrypted information on programs and locked prospects out of its SendPro merchandise, postage refill, and account obtain, but the firm explained no buyer or employee data was compromised.

The preceding attack is recognized to have included Ryuk ransomware, which is suspected to be operated by groups out of Russia, and it is not recognised irrespective of whether Pitney Bowes compensated the ransom on that situation.

But according to menace scientists, there is a probability that the two assaults, even though relying on unique types of ransomware, may perhaps be joined in some way, although this is by no signifies tested.

According to a study announcement from Microsoft’s threat intel crew, numerous ransomware attackers have “deliberately taken care of their presence on some endpoints, intending to reinitiate destructive exercise following a ransom is paid out or techniques are rebuilt”.

This may perhaps be a even more clue that cyber criminals may possibly have received accessibility to privileged qualifications at Pitney Bowes and have either sold them on to a team employing Maze or reused them after gaining obtain to Maze by themselves. In accordance to FireEye Mandiant risk scientists, Maze appears to run an affiliate design, partnering with other risk actors and then getting a minimize of the commission if a ransom is paid out.

Microsoft said Maze is most typically shipped through electronic mail, but some of its operators have deployed it to sufferer networks utilizing RDP (remote desktop protocol) brute drive attacks, generally utilizing unchanged community administrator passwords. Acquiring finished this, they then steal credentials and move laterally by way of the community to exfiltrate data.

Utilizing the brute-forced password, marketing campaign operators ended up able to transfer laterally since crafted-in administrator accounts on other endpoints applied the exact passwords, stated the firm’s researchers.

“After getting management over a domain admin account via credential theft, marketing campaign operators used Cobalt Strike, PsExec and a myriad of other tools to deploy different payloads and entry knowledge,” wrote Microsoft’s scientists.

“They established fileless persistence utilizing scheduled duties and companies that introduced PowerShell-primarily based distant shells. They also turned on Windows Remote Management for persistent handle working with stolen domain admin privileges. To weaken safety controls in planning for ransomware deployment, they manipulated various settings by way of Group Coverage.”