iNSYNQ Ransom Attack Began With Phishing Email
Summary: A ransomware outbreak at QuickBooks cloud hosting firm iNSYNQ in mid-July began with a targeted phishing email that snared an employee in the company's sales division, with intruders spending roughly ten days inside the internal network before deploying MegaCortex ransomware. iNSYNQ declined to pay the ransom, contained encryption to roughly 50 percent of customer systems, and had restored access to more than 90 percent of customer files by Aug. 2, though CEO Elliot Luchansky said some backups were also infected because the malware had spread into them.
What you should know: The intruders had roughly ten days inside the network before encrypting anything, and the malware reached the backups too - so the recovery path a security leader counts on most was itself compromised, leaving customers waiting weeks and iNSYNQ offering a two-month credit.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·