The group has recruited a team of affiliates who carry out attacks on corporate networks.<\/p>\n
One security researcher, who goes by Ransom Leaks<\/a><\/strong> on Twitter, told MyBroadband that Sodinokibi is a “ransomware as a service” platform.<\/p>\n “Hackers actually sign up as partners or affiliates and deploy this ransomware. When a victim pays for decryption the partner gets like 60% of the ransom,” the researcher said.<\/p>\n “This leaking is part of the platform’s service to its partners to help them win more payments.”<\/p>\n Ransom Leaks speculated that the Sodinokibi \/ REvil affiliate could easily have tried to extort $1 million (USD) out of Telkom.<\/p>\n “This ransomware group is known to go ‘Big Game Hunting’, so the ransom could be quite large.”<\/p>\n (Click to enlarge)<\/p><\/div>\n These further reports that Telkom was indeed the victim of a ransomware attack<\/strong><\/a> come after the company denied<\/strong><\/a> that its systems had been infected with ransomware.<\/p>\n Telkom later amended its official statement to say that it did not have the PonyFinal ransomware.<\/p>\n This followed industry speculation that Telkom fell prey to the PonyFinal ransomware, for which Microsoft Security Intelligence issued an alert<\/a><\/strong> on 27 May.<\/p>\n Industry sources told MyBroadband that downtime across several Telkom systems over the weekend, including its call centre, was due to a ransomware attack.<\/p>\n Staff working remotely were unable to connect to servers or the Telkom virtual private network.<\/p>\n However, Telkom told MyBroadband that it was just dealing with a malware infection, not ransomware.<\/p>\n Telkom said that it became aware of an internal malware infection on Friday, 29 May 2020, and shut down all systems and call centres as a precaution. Its network remained operational during this time, Telkom said.<\/p>\n Some systems were restored on Saturday, though Telkom’s call centres remained offline. By Monday, Telkom announced that its call centres were back online.<\/p>\n Brett Callow, a threat analyst with Emsisoft, said that Telkom’s statement that it was not infected with ransomware may be accurate even if\u00a0REvil is responsible for the attack.<\/p>\n “Actors typically have access to a network for days, weeks or even months attempting to deploy ransomware and use that time to move laterally through the network and, in some cases, steal data,” Callow said.<\/p>\n “It\u2019s possible that REvil was able to exfiltrate some data, but Telkom noticed and neutralized the attack prior to ransomware being deployed and having important files encrypted.”<\/p>\n Currently, the Sodinokibi blog on the dark web only contains a placeholder for the Telkom attack.<\/p>\n “They have never taken credit for something they didn’t do,” Ransom Leaks told MyBroadband.<\/p>\n The researcher explained that the group will publish some samples of the Telkom client database, followed by multiple rounds of leaks.<\/p>\n “They will give Telkom more time to pay to stop the future leaks by breaking it into multiple leaks.”<\/p>\n Telkom acknowledged MyBroadband’s request for comment and said it would provide feedback as soon as it was able.<\/p>\n Telkom has fallen victim to the group behind the Sodinokibi ransomware, also known as REvil, security researchers have told MyBroadband.<\/p>\n","protected":false},"author":15,"featured_media":281321,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[35,64965,64961,64963,109],"class_list":["post-354585","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-headline","tag-ransom-leaks","tag-revil","tag-sodinokibi","tag-telkom"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/354585"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=354585"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/354585\/revisions"}],"predecessor-version":[{"id":354601,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/354585\/revisions\/354601"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/281321"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=354585"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=354585"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=354585"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Attack on Telkom<\/h3>\n
![\"Screenshot](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2020\/06\/Telkom-REvil-ransomware-client-database-leak-640x336.jpg\")
<\/a>Stolen Telkom data will be leaked slowly – Researcher<\/h3>\n
Now read: Data leak on UIF COVID-19 relief scheme website<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"