An MSP bowed to hacker demands and paid more than $150,000 to recover data after a ransomware attack, UBX Cloud asserts without revealing the managed IT service provider's company name.The hackers targeted RMM (remote monitoring and management) software and a cybersecurity management dashboard to infiltrate MSP systems and extend ransomware out to end-customer systems, MSSP Alert has previously reported.The attack involved compromised credentials rather than any type of breach or product compromise, Webroot and Kaseya both determined. As an added precaution, Webroot has now made two-factor authentication mandatory.
Related: Judgment Day arrives for MSPs as ransomware threatens entire industry's credibility.
In a follow-up report about the attack, UBX Cloud asserted:UBX Cloud did not mention the MSP by name, nor did the company say if the MSP successfully decrypted the data. At least three MSPs were hit by the attack, according to research from Huntress Labs. The victims included IT By Design, according to CRN.The MSP's ransomware payment comes only a few days after the city of Riviera Beach, Florida, paid hackers $600,000 to unlock its ransomware-infected systems.
"Roughly 30% of the end-user systems impacted by the attack were quickly recoverable because the victim of the attack utilized UBX Cloud’s Veeam-powered air-gapped offsite backups, which allowed those users to recover their systems in less than 30 minutes. However, recovering the remaining 70% of the impacted systems cost the MSP over $150,000 in bitcoin to gain access to the decryption keys, required to recover the data that was not protected by air-gapped backups."
