2023年4月17日

NCR黑猫奔跑着的受害者/ ALPHV ransomware帮派,这次袭击造成停机在公司的迎宾PoS平台。NCR公司,以前被称为国家现金出纳机,是一家美国软件、咨询和技术公司提供几个专业服务和电子产品。它生产的自助服务亭,销售点终端,自动柜员机,检查处理系统,条形码扫描仪。NCR正在遭受停机周三以来迎宾销售点平台后,受到ransomware黑猫奔跑着攻击由/ ALPHV ransomware组。NCR迎宾POS是一个全面的餐饮销售点和管理软件,该公司声称它是比任何其他收银员和服务器所使用的POS行业中。公司已经开始通知客户,确认ransomware攻击:“NCR公司的重要客户,我们接触了关于一个附加信息数据中心故障影响有限数量的辅助迎宾申请接待客户的一个子集。我们4月13日证实,宕机ransomware事件的结果。”发送的通知公司客户通过电子邮件。NCR通知执法和第三方网络安全专家对事件进行调查,确定攻击的范围。公司指出,餐馆的影响仍然可以服务顾客,事件只影响一个特定的功能。“只有特定功能受损。 There is no impact to payment applications or on-premises systems.” continues the notice. Source Tritter: Account @ SoloClaudio As reported by BleepingComputer, many customers are reporting [ 1 , 2 ] the problems they are facing due to the outage. The BlackCat/ALPHV ransomware gang initially added NCR to the list of victims on its Tor data leak site, below the Tweet from the cybersecurity researcher Dominic Alivieri. The expert also published a chat message related to the negotiation between NCR and the ransomware gang. The ransomware gang claims to have stolen credentials belonging to NCR’s customers and threatens to use them and leak them if the ransom was not paid. NCR Corporation breached by Black Cat. https://t.co/6beimfrsze pic.twitter.com/Bnh6s3RKfu At the time of this writing the group has removed the name of NCR from its leak site, likely because there is an ongoing negotiation. The ransom demands of the group range from a few tens of thousands of dollars up to tens of millions of dollars. Unlike other ALPHV affiliates, UNC4466 doesn’t rely on stolen credentials for initial access to victim environments. Mandiant researchers first observed this affiliate targeting Veritas issues in the wild on October 22, 2022. Please vote for Security Affairs ( https://securityaffairs.com/ ) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections: The Teacher – Most Educational Blog The Entertainer – Most Entertaining Blog The Tech Whizz – Best Technical Blog Best Social Media Account to Follow (@securityaffairs) Please nominate Security Affairs as your favorite blog. Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”. Previous Article