Major Argentine Telecom Falls Victim to $7.5M Monero Ransomware Attack

Telecom, Argentina’s largest telecommunications company, has fallen victim to a ransomware attack. Hackers are demanding $7.5 million in Monero (XMR) — an amount that will rise to $15 million if the company does not pay within 48 hours.

Argentina’s major telephone company, Telecom, just got hacked. Hackers requesting a ransom of $7.5 million in Monero. $XMR pic.twitter.com/AGNvAXh1cg

— Alex Krüger (@krugermacro) July 19, 2020

According to El Tribuno, the ransomware attack, which specifically affected Telecom’s call center, took place on July 18. The ransomware was ultimately contained by the Argentinian conglomerate’s IT workers. In a statement issued to local media outlets, the company elaborated:

“Telecom reports that it managed to contain a cyber attack attempt, of global dispersion, on its platforms. No critical services of the company were affected. It should also be noted that no client of the company was affected by this situation, as well as the bases of company data. Customer service efforts, suspended preventively, will be gradually restored.”

The attack does not seem to have affected services provided by the company such as landlines, mobile phones, or the internet.

An alleged well-known ransomware gang behind the attack

ZDNet quotes sources inside the ISP provider who say that hackers caused “extensive damage” to the Telecom’s network. They claim the hackers successfully deployed their ransomware to more than 18,000 workstations across the company.

The report also adds that REvil ransomware gang, or Sodinokibi, could be behind the attack, as the hackers posted a tweet claiming its responsibility by attaching a screenshot of the website, but it was deleted at some point between July 19 and July 20.

But as the hacker’s point of entry was a malicious email attachment sent to one of Telecom’s employees doesn’t fit at all with the tactics used by the gang, as they often deploy the attack via network-based intrusions by targeting vulnerabilities within the IT infrastructure.

Sites hosted in Telecom Argentina are back after the incident

As of press time, most of the official websites belonging to Telecom are now online after a downtime suffered after the attack.

One of the most prominent tweets is an image from a seemingly official company statement in which it acknowledges the attack and lists a series of recommendations for its employees to follow.

— GuyWithAMask (@GuyWithAMask4) July 19, 2020

Telecom Argentina didn’t provide further information to the local media outlets about the incident. It is unknown whether they plan to pay the ransom.

REvil said on July 24 that they will auction over 1TB of data stolen from New York-based entertainment law firm, Grubman Shire Meiselas & Sacks. This data allegedly contains the “dirty” secrets of a number of celebrities.