Chemical distribution company “Brenntag” has paid a ransom of $4.4 million in Bitcoin to the DarkSide ransomware gang in order to receive a decryptor for the encrypted files and to prevent the hackers from leaking the stolen data. Brenntag is a leading chemical distribution company based in Germany , which currently has more than 17,000 employees, in more than 670 locations .
According to the ICS Top 100 Chemical Distributors report, Brenntag is the second largest sales company in North America.
Read also: DarkSide ransomware: After Colonial Pipeline, it targets three more companies
In early May, the company suffered a ransomware attack targeting the North American company. As part of this attack, hackers encrypted devices on the company's network and stole unencrypted files.
The DarkSide ransomware gang claimed to have stolen 150GB of data during the attack. To prove their claims, the gang created a private data leak page that contained a description of the types of data that had been stolen, as well as screenshots of some of the files.
The ransomware gang initially demanded a ransom of 133.65 Bitcoin (approximately $7.5 million) from the company. However, after negotiations, the ransom demand was reduced to $4.4 million and the ransom was paid on May 11.
See also: FBI and CISA issued an alert about DarkSide ransomware
Brenntag said in a statement: “Brennentag North America is currently working to resolve a limited information security incident. Upon learning of this incident, we disconnected the affected systems from the network to mitigate the threat. In addition, third-party cybersecurity and forensic experts immediately volunteered to assist in the investigation of the incident. We have also notified law enforcement of this incident.”
DarkSide is a Ransomware-as-a-Service (RaaS) operation, in which ransomware developers work with third-party partners or hackers, who are responsible for gaining access to a network and encrypting devices. Under this arrangement, the DarkSide core gang earns 20-30% of a ransom payment, and the remaining portion of the ransom goes to the partner who carried out the attack.
In most ransomware negotiations, the accomplice reveals how they gained access to a victim's network. This can be in the form of a multi-page security audit report or just a simple paragraph on the Tor chat screen explaining how the hackers gained access.
Suggestion: Ransomware gangs have leaked data from over 2,100 companies so far!
In this case, the DarkSide gang associate claims to have gained access to the company's network after purchasing stolen credentials. However, he said he does not know how the credentials were originally obtained.
Ransomware gangs and other malicious actors commonly use dark web marketplaces to purchase stolen credentials, especially those involving Remote Desktop credentials.
Last month, one of the largest RDP marketplaces, UAS, suffered a breach that showed that 1.3 million stolen credentials were accessed over the past three years.
This attack demonstrates the importance of implementing multi-factor authentication (MFA) for all connections to a network and placing all Remote Desktop servers behind a VPN. If MFA was enabled for account login, it would be unlikely that DarkSide's gang member would gain access to the network.
Information source: bleepingcomputer.com
