Ness Digital Engineering Company, an Israeli-based U.S. IT provider was targeted via ransomware cyberattack affecting computer networks in India, United States, and Israel too. No official statement has been given to the media by the local authorities but initial reports suggest that there's a high probability of Israel being the source of the attack following Ness branches around the globe.
Shahar Efal, CEO of Ness Israel said that the company’s clients which include government ministries, hospitals, and local municipalities were not compromised in the attack. All our systems had been tested by the experts and there is not a single breach into the company’s network or in its client’s database. Cybersecurity experts say the real issue is that the company’s supply chain is intact or it is breached in the attack, so far there are no reports of negotiations with the threat actors.
“The attack began last night, it is a serious, ongoing event. The company is trying to contain the attack internally and seemed, thus far, to have successfully contained it without risking customers”, a source involved in managing the attack told Ynet. The company reassured its clients by reiterating that Ness Israel was no longer connected to the global corporation and therefore was not affected by the cyberattack.
The company has collaborated with several other companies and government bodies such as the IDF, Israel Aerospace Industries, Israel Post, the Israel Airport Authority, and the Hebrew University. National Cyber Directorate stated this attack has no connection with Israel. Meanwhile, Cybersecurity Consultant Einat Meyron said that more than 150 servers in Israel and 1,000 servers around the globe are tested by McAfee.
A screenshot of the text presented as a part of the ransomware attack reads “Hello ness-digital-engineering! If you (sic) reading this message, it means your network was PENETRATED and all of your files and data has (sic) been ENCRYPTED by RAGNAR LOCKER!” The text directs the company to get in touch via live chat provided in the text to sort out the case and “make a deal”.
Ranger Locker ransomware technique was used by the threat actors to gain access to a victim’s network and perform exploration to locate network assets, backups and other critical files and manually install the ransomware and encrypt the victim’s data.