US Company TTEC Suffers Ransomware Attack
TTEC, an American-based customer experience company with tens of thousands of employees and operations in over 20 countries worldwide, suffered a ransomware attack.
The incident was reported by independent security researcher Brian Krebs. A source of his reported that the company sent an internal message to employees, concerning a large-scale issue with its networks that took place on Sunday.
After an initial unsuccessful attempt to contact the company for more information, Krebs later updated the information he published with the company's official statement, which confirms the system issue was indeed a ransomware attack.
The ransomware used in the attack is Ragnar Locker, which means the Ragnar ransomware gang is behind the attack, or someone who is trying to pass for them, Krebs speculated. According to the message Krebs received from the company employee, TTEC was warning its staff against clicking on a file named !R!A!G!N!A!R with an alphanumeric string following the name. Somewhat strangely, the message referred to the file as a "nuisance message".
TTEC contacted ZDNet and formally confirmed the attack was indeed ransomware as well. In the wake of the attack, the company stated that regular business operations in several of its facilities have been temporarily stopped.
The company made sure to reiterate the rest of the usual things done under standard ransomware protocol - affected portions of networks have been isolated and are being now restored to working order, while an investigation has been launched and is still in progress.
We recently covered the Ragnar ransomware gang, when they made a strange attempt to scare their future victims into cooperation, threatening to both leak sensitive stolen information and irreversibly destroy the decryption key linked to any victim who contacts the federal authorities and launches an investigation involving infosec professionals or ransom negotiation experts.
