Cygilant, a threat detection cybersecurity company, has confirmed a ransomware attack.
Christina Lattuca, Cygilantβs chief financial officer,Β said in a statement that the companyΒ was βaware of a ransomware attack impacting a portion of Cygilantβs technology environment.β
βOur Cyber Defense and Response Center team took immediate and decisive action to stop the progression of the attack. We are working closely with third-party forensic investigators and law enforcement to understand the full nature and impact of the attack. Cygilant is committed to the ongoing security of our network and to continuously strengthening all aspects of our security program,β the statement said.
Cygilant is believed to be the latest victim of NetWalker, a ransomware-as-a-service group, which lets threat groups rent access to its infrastructure to launch their own attacks,Β according to Brett Callow, a ransomware expert and threat analyst at security firm Emsisoft.
The file-encrypting malware itself not only scrambles a victimβs files but also exfiltrates the data to the hackerβs servers. The hackers typically threaten to publish the victimβs files if the ransom isnβt paid.
A site on the dark web associated with the NetWalker ransomware group posted screenshots of internal network files and directories believed to be associated with Cygilant.
Cygilant did not say if it paid the ransom. But at the time of writing, the dark web listing with Cygilantβs data had disappeared.
βGroups permanently delist companies when theyβve paid or, in some cases, temporarily delist them once theyβve agreed to come to the negotiating table,β said Callow. βNetWalker has temporarily delisted pending negotiations in at least one other case.β
Cyber threat startup Cygilant hit by ransomware by Zack Whittaker originally published on TechCrunch