IoT chip maker Advantech confirms ransomware attack, data theft

11/30/20 Update below. This post was originally published on November 28th, 2020. It has been updated to reflect Advantech's confirmation of the attack.

Industrial automation and Industrial IoT (IIoT) chip maker Advantech confirmed a ransomware attack that hit its network and led to the theft of confidential, albeit low-value, company documents.

BleepingComputer was also able to confirm that the Conti ransomware gang was the one that hit the systems of Advantech and is now demanding a $14 million ransom to decrypt affected systems and to stop leaking stolen company data.

Advantech is a global leading manufacturer of IT products and solutions, including embedded PCs, network devices, IoT, servers, and healthcare solutions, with a workforce of over 8,000 people in 92 major cities around the world.

The company was the world industrial computing leader with a 34% WW Market Share in 2018 and it reported a yearly sales revenue of over $1.7 billion in 2019.

Ransom set at 750 Bitcoins

The Conti operators behind the attack on Advantech's network have set a ransom of 750 BTC (roughly $12,600,000 at today's exchange rate) for full data decryption and for removing stolen data from their servers according to a chat log seen by BleepingComputer.

Conti also said that they are willing to decrypt two of the encrypted files before the ransom is paid as proof that their decryptor works.

The ransomware operators added on November 21, 2020, that they will leak part of the stolen data if there was no reply from the company within the next day.

On November 26, the group began publishing Advantech's data on their ransomware data leak site as a 3.03GB archive with 2% of the stolen data and a text document with a list of files included in the ZIP archive.

The ransomware gang also stated that if the ransom is paid they will immediately remove any backdoors deployed on the company's network and will provide security tips on how to secure the network to block future breaches.

They also said that any stolen data would be deleted once the payment goes through. Despite their promises, research by ransomware negotiation firm Coveware has shown that some ransomware operations don't actually remove deleted files after a ransom payment is made.

While the company has not issued any public statements regarding the ransomware attack on its systems, BleepingComputer was able to obtain a copy of the ransom note the Conti operators deployed on Advantech's encrypted sytems.

An Advantech spokesperson confirmed the ransomware attack and that data was stolen from the company's systems but did not comment on Conti's ransom demands.

Advantech, a global leader in industrial IoT, has implemented countermeasures against the recent malicious cyberattacks. We have activated and updated our information security and protection mechanisms, and our current status is detailed below: 

  • Some data may have been stolen by hackers due to a small number of Advantech servers which were attacked. According to our internal risk evaluation, the stolen data was confidential but only contained low-value documents.
  • The attacked OA server has gradually recovered and the important operating systems are all functioning normally. 
  • At the same time, Advantech has also carried out data preservation and system upgrades related to customer information security and operating systems.
  • Some media reported that Advantech was blackmailed, which is in line with the purpose of most general cyberattacks. Advantech will not be commenting on this.

While resolving this incident, Advantech has introduced new detection, protection, and response actions into our cyber security strategies to mitigate risks of future attacks. We hope that our global colleagues, partners, and customers remain patient throughout the recovery period as we overcome this major cyberattack setback.

The Conti ransomware

Conti ransomware was first spotted in isolated attacks at the end of December 2019, with attacks picking up in June 2020.

This ransomware shares code with the notorious Ryuk Ransomware and began being distributed through reverse shells opened by the TrickBot trojan after Ryuk activity dwindled down in July 2020.

Conti operators breach corporate networks and spread laterally until they gain access to domain admin credentials that allow them to deploy the ransomware payloads used to encrypt devices.

Operating as a private Ransomware-as-a-Service (RaaS) that recruits experienced hackers to deploy the ransomware in exchange for large ransom shares, Conti opened their own data leak site with twenty-six victims in August 2020.