[Sikom]

Security observations
Capcom hit by Ragnar Locker ransomware
---------------------------------------------------------------------------------
The Japanese game developer Capcom, has reported being hit by the Ragnar Locker ransomware on November 2nd. The attackers are claiming to have gained access to 1TB of sensitive data and are attempting to extort the company for 11 million dollars in bitcoins.

The group claims to have encrypted 2000 devices and the data stolen allegedly includes everything from financial data and documents, intellectual property, client and employee personal information, in addition to other company sensitive information. The group threatens to auction/publish this data if their demands are not met. Capcom is known for their franchises such as Street Fighter, Monster Hunter, Resident Evil and Mega Man.

https://www.bleepingcomputer.com/news/se...ly-stolen/

Vulnerabilities

None in particular.

Source -  mnemonic AS newsletter

[mothered]

This Is a major breach.

It'll be Interesting to see whether the company complies with the attacker's request.

[Sikom]

This Is a major breach.

It'll be Interesting to see whether the company complies with the attacker's request.

I guess only time will tell. Hopefully not too much sensitive personal info though.

[mothered]

This Is a major breach.

It'll be Interesting to see whether the company complies with the attacker's request.

I guess only time will tell. Hopefully not too much sensitive personal info though.

Due to the nature of the data, I'd say they'll most likely pay the demand.

Here's a snippet from the article that's quite concerning.

Ragnar Locker claims to have encrypted 2,000 devices on Capcom's networks and are demanding $11,000,000 in bitcoins for a decryptor.

[Sikom]

This Is a major breach.

It'll be Interesting to see whether the company complies with the attacker's request.

I guess only time will tell. Hopefully not too much sensitive personal info though.

Due to the nature of the data, I'd say they'll most likely pay the demand.

Here's a snippet from the article that's quite concerning.

Ragnar Locker claims to have encrypted 2,000 devices on Capcom's networks and are demanding $11,000,000 in bitcoins for a decryptor.

To be honest, the amount of devices doesn't necessarily mean anything. The data on the devices is what's important in this circumstance.
What I do wonder is how this was not discovered, since it must be quite a bit of exfiltrating. Maybe SNIcat?

[mothered]

To be honest, the amount of devices doesn't necessarily mean anything. The data on the devices is what's important in this circumstance.

In this particular breach, I'm evaluating the nature of the data against the number of devices- both of which are significant, and certainly a cause for concern:

The attackers are claiming to have gained access to 1TB of sensitive data

What I do wonder is how this was not discovered, since it must be quite a bit of exfiltrating. Maybe SNIcat?

Perhaps an Inside job?

[Sikom]

To be honest, the amount of devices doesn't necessarily mean anything. The data on the devices is what's important in this circumstance.

In this particular breach, I'm evaluating the nature of the data against the number of devices- both of which are significant, and certainly a cause for concern:

The attackers are claiming to have gained access to 1TB of sensitive data

What I do wonder is how this was not discovered, since it must be quite a bit of exfiltrating. Maybe SNIcat?

Perhaps an Inside job?

Seems like Ragnar locker is pretty targeted towards each victim. I do however believe that it would be harder and risky to try to infiltrate the company to exfiltrate the data.