On October 21, Sopra Steria, a leading French IT company, announced that it had suffered a hacking attack on October 20, in which parts of its network were encrypted by the Ryuk ransomware. However, the company provided little information about the incident. Sopra Steria is a European IT company that currently employs 46,000 people in 25 countries worldwide. The company provides a wide range of IT services, including consulting ,systems integration and software.
The French IT company said that security measures have been taken to limit the risks. It also stressed that its staff is working hard to restore as quickly as possible and to ensure business. Sopra Steria is also in close contact with its customers and partners, as well as with the relevant authorities.
A source with knowledge of the incident told BleepingComputer that Sopra Steria’s network was encrypted by Ryuk ransomware, which has affected numerous healthcare services around the world. Multiple sources have also told French IT website “LeMagIT” that the Ryuk ransomware gang is behind the attack . This gang is known for the TrickBot and BazarLoader that allow hackers to gain access to a compromised network and deploy the Ryuk/Conti ransomware.
BazarLoader is increasingly being used in Ryuk ransomware attacks against high-profile targets, as it is more difficult to detect by security software, compared to TrickBot. When installed on a target's system, BazarLoader allows hackers to remotely access the victim's computer and use it to compromise the rest of the network. After gaining access to a Windows domain controller , the attackers then deploy Ryuk ransomware to the network to encrypt all devices on it.
