Taiwan MSI falls for ransomware attacks

MSI, a Taiwanese computer manufacturer also known as Micro-Star International, has officially acknowledged that its systems were targeted in a cyber assault. The organization stated that it rapidly launched incident management and remediation procedures upon identifying unusual network activity.

SCAM ALERT NOTICE.#MSI pic.twitter.com/dzzmXEPkmt

— MSI (@msitweets) February 17, 2023

It also informed law enforcement agencies of the situation. However, MSI did not reveal any precise information about the timing of the attack or whether it involved the theft of any confidential data.

What’s a take?

In a press release,  “MSI urges users to obtain firmware/BIOS updates only from its official website, and not to use files from sources other than the official website.”

The intruders are called Money Message which is a new gang identified by Zscaler.

💰ThreatLabz has discovered a new #ransomware group named Money Message performing double extortion attacks.

Sample hash: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b

Data leak site: blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd[.]onion pic.twitter.com/P7xYnHy6wL

— Zscaler ThreatLabz (@Threatlabz) March 29, 2023

According to Cyble

Money Message can 

• encrypt network shares and targets both Windows and Linux operating systems. 
• Upon analysis, they contain admin credentials in the configuration, which were then used to target network resources
• threat actors (TA)s might be leveraging stealer logs in their operation.  

“The group utilizes a double extortion technique to target its victims, which involves exfiltrating the victim’s data before encrypting it. The group uploads the data on their leak site if the ransom is unpaid. “

Fold your arms against ransomware attacks

Safety measures are to be taken to stay away from ransomware attacks: 

• Keeping regular backup practices online and offline in a separate network.   
• Turn on the automatic software update feature on your computer, mobile, and other connected devices wherever possible.
• Use only reliable antivirus and Internet security software packages on your connected devices.  
• Avoid opening untrusted links and email attachments without verifying their authenticity.   

Final note

Checked the above-mentioned safety measures?! You are one step ahead to encounter the ransomware attack that comes your way. Stealing techniques are evolving and so do prevention tricks. It is always a better idea to keep yourself updated and know about potential risks you could be prey to.

Stay vigilant, and learn to be safe!