Ransomware crooks attack Conduent, another large IT provider

Maze is but one of a series of ransomware affiliates that like to target IT services companies.

A ransomware attack disrupted IT services company Conduent’s work with its clients last week, another example of digital extortionists targeting key technology suppliers.

Conduent, which reported $4.5 billion in revenue last year and provides IT services in sectors such as health care and banking, had its European operations temporarily hampered, spokesman Sean Collins said. The incident occurred on May 29. Most systems were functioning nine hours later on that same day, and all have since been restored, he said.

It was unclear which Conduent clients were affected by the disruption. Collins did not respond to a question on which clients were affected.

The notorious set of hackers behind the Maze ransomware variant claimed responsibility. Like a lot of crooks involved in ransomware, the Russian-speaking Maze affiliates are not one group, but several distinct teams that specialize in writing code or breaching networks.

If confirmed, it would be at least the second multibillion-dollar IT services company that Maze has infected in the last two months. Cognizant, a Fortune 500 company with over a quarter of a million employees, announced a Maze incident in April.

Maze is but one of a series of ransomware affiliates that like to target IT services companies and then boast about having access to sensitive corporate data. The hackers use victim-shaming websites to pressure companies to pay a ransom, and then dump data if the demands aren’t met.

“Ransomware threat actors like IT and managed service providers [MSP] because they can provide the attacker with easy access to many targets, some of which are potentially lucrative,” said Allan Liska, a ransomware specialist at threat intelligence company Recorded Future.

Collins, the Conduent spokesman, said the company is still doing a post-mortem on the breach.

“As our investigation continues, we have ongoing internal and external security forensics and anti-virus teams reviewing and monitoring our European infrastructure,” he said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure