{"id":13299,"date":"2022-02-15T01:50:09","date_gmt":"2022-02-15T01:50:09","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/15\/data-stolen-in-ransomware-attack-on-san-francisco-49ers\/"},"modified":"2022-02-15T01:50:09","modified_gmt":"2022-02-15T01:50:09","slug":"data-stolen-in-ransomware-attack-on-san-francisco-49ers","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/15\/data-stolen-in-ransomware-attack-on-san-francisco-49ers\/","title":{"rendered":"Data stolen in ransomware attack on San Francisco 49ers"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

American football team the San Francisco 49ers has been struck by a ransomware attack with financial data stolen.<\/p>\n

The credit for the attack has been taken by a ransomware gang going by the name of BlackByte. The gang first emerged in July<\/a> and was the subject of a joint cybersecurity advisory by the U.S. Federal Bureau of Investigation and the Secret Service on Feb. 11<\/a>.<\/p>\n

BlackByte is said to have previously targeted multiple U.S. and foreign businesses, including entities in at least three U.S. critical infrastructure sectors. The gang runs a ransomware-as-a-service operation that encrypts files on compromised Windows host systems, including physical and virtual services.<\/p>\n

\u201cBlackByte is a growing ransomware operator that has had success following successful patterns implemented by previous groups,\u201d\u00a0Matthew Warner, chief technology officer and co-founder at automated threat detection and response company\u00a0Blumira Inc.<\/a>, told SiliconANGLE. \u201cSimilar to Conti ransomware, BlackByte has been identified using Exchange vulnerabilities such as ProxyShell to gain a foothold in environments. Additionally, BlackByte utilizes well-proven tactics such as Powershell exploitation of obfuscated base64 content to perform all encryption on hosts once exploited.\u201d<\/p>\n

The news that the 49ers had been hacked first came after BlackByte published samples of stolen documents on its dark web page over the weekend. The team subsequently confirmed it had been hacked on Sunday, describing the attack as a \u201cnetwork security incident\u201d that had disrupted some of its corporate IT network systems.<\/p>\n

The 49ers ticked off the standard responses to a ransomware attack, saying<\/a> that they had informed law enforcement and had hired a third-party cybersecurity company to assist in an investigation. The team added that they \u201cno indication that this incident involves systems outside of our corporate network, such as those connected to Levi\u2019s Stadium operations or ticket holders.\u201d Levi\u2019s Stadium is the 49ers home stadium.<\/p>\n

It\u2019s not clear what the ransom amount being demanded by BlackByte is, but typical attacks by such groups usually involve ransom demands in the millions.<\/p>\n

Anneka Gupta, chief product officer at cloud data management company Rubrik Inc.<\/a> noted that the \u201cransomware attack on the San Francisco 49ers demonstrates how ransomware is infiltrating every aspect of our lives, from critical infrastructure, such as schools and hospitals to professional sports teams and entertainment.\u201d<\/p>\n

\u201cRansomware-as-a-service groups, including BlackByte, have evolved into incredibly well-funded, sophisticated organizations whose entire purpose is to wreak havoc on victims in hope of payout,\u201d Anneka added. \u201cAlarmingly, often these groups purposefully carry out attacks during holidays \u2014 or during the biggest event of the NFL season when all eyes are on the league \u2014 in hopes that their victims will be unprepared.\u201d<\/p>\n

Keith Neilson, technical evangelist at cyber asset management company CloudSphere,<\/a> warned that\u00a0\u201cwhile the San Francisco 49ers discovered a ransomware attack and acted immediately to remediate disruptions to their network, less high-profile organizations may not be as fortunate.\u201d<\/p>\n

Photo: John Martinex Pavliga\/Wikimedia Commons<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n