![\"Maze](\"https:\/\/www.bleepstatic.com\/content\/hl-images\/2019\/11\/21\/maze-rw.jpg\")
<\/p>\n<\/p>\n
The Maze Ransomware operators are claiming to have successfully attacked business services giant Conduent, where they stole unencrypted files and encrypted devices on their network.<\/p>\n
Conduent is a New Jersey, USA based business services firm with 67,000 employees and a 2019 business revenue of $4.47 billion.<\/p>\n
Today, Maze Ransomware posted a new entry to their data leak site that states that they breached the network for Conduent in May 2020.<\/p>\n
When conducting an attack, the Maze Ransomware operators steal unencrypted files before deploying the ransomware. This stolen data and the threat of publicly releasing it is then used as leverage to ‘persuade’ the victim to pay a ransom.<\/p>\n
As ‘proof’ that the threat actors breached Conduent, 1GB worth of files were posted that allegedly was stolen during the ransomware attack. <\/p>\n
The posted files are called ‘BusinessIntelligence.zip’ and ‘Compliance1.zip’ and include various financial spreadsheets, customer audits, invoices, commission statements, and other miscellaneous documents.<\/p>\n
Due to the varied types of data already posted by the Maze gang, Conduent must disclose it as a data breach to their clients and employees.<\/p>\n
In a statement to BleepingComputer, Conduent confirmed that they suffered a ransomware attack on May 29th, 2020 that impacted services for approximately 10 hours.<\/p>\n
“Conduent’s European operations experienced a service interruption on Friday, May 29, 2020. Our system identified ransomware, which was then addressed by our cybersecurity protocols. This interruption began at 12.45 AM CET on May 29th with systems mostly back in production again by 10.00 AM CET that morning, and all systems have since then been restored. This resulted in a partial interruption to the services that we provide to some clients. As our investigation continues, we have on-going internal and external security forensics and anti-virus teams reviewing and monitoring our European infrastructure.”<\/p>\n
Threat intelligence company Bad Packets stated that for at least eight weeks, between December 17, 2019, and at least February 14, 2020, Conduent had a Citrix server exposed that was vulnerable to the CVE-2019-19781 vulnerability<\/a>.<\/p>\n This vulnerability was patched in January 2020<\/a> and allowed attackers to perform remote code execution on vulnerable devices.<\/p>\n Using these devices as a staging area, attackers would then spread laterally throughout the internal network as they compromise further devices.<\/p>\n The CVE-2019-19781 vulnerability is known to be used by threat actors in the past to breach networks and deploy ransomware.<\/p>\n In a report highlighting human-operated ransomware<\/a>, the Microsoft Threat Protection Intelligence Team states that DoppelPaymer and RobbinHood have been seen utilizing the vulnerability to breach corporate networks.<\/p>\n In April 2020, when we broke the news that Maze breached IT services company Cognizant<\/a>, Bad Packets also found vulnerable Citrix NetScaler gateways on their network.<\/p>\n While it is not confirmed if this vulnerability was used as part of this attack, the Maze Ransomware operators have been known to use vulnerabilities to gain access to networks in the past.<\/p>\n Tags:<\/b> Lawrence Abrams<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":" The Maze Ransomware operators are claiming to have successfully attacked business services giant Conduent, where they stole unencrypted files and encrypted devices on their network. Conduent is a New Jersey, USA based business services firm with 67,000 employees and a 2019 business revenue of $4.47 billion. Today, Maze Ransomware posted a new entry to their data … Continue reading Business services giant Conduent hit by Maze Ransomware<\/span><\/a> Continue Reading See Campaign: <\/strong>https:\/\/www.bleepingcomputer.com\/news\/security\/business-services-giant-conduent-allegedly-hit-by-maze-ransomware\/<\/a>
Contact Information:<\/b>
Lawrence Abrams<\/p>\n
<\/a>, Wire<\/a>, United States<\/a>, English<\/a><\/p>\n<\/div>\n
\nContact Information:<\/h3>\n