49ers Hit by Digital Attack During Super Bowl

The San Francisco 49ers were hit by ransomware attackers this weekend.  The attackers stole confidential financial information.  Here’s a quick look at the details of the attack.  

Which Ransomware Group Stole the Data?

BlackByte is claiming responsibility for the ransomware attack.  The group allegedly posted the stolen financial information to a website on the dark web.  The financial details were posted in a filed labeled “2020 Invoices.”  

What Does BlackByte Want in Return for the Data?

BlackByte insists it will return the rest of the stolen data and stop posting stolen information to the web if the San Francisco 49ers meet specific demands.  However, the ransomware gang did not publicly reveal those specific demands.  Nor did these hackers reveal the amount of information taken from the team’s website and subsequently encrypted.

How Did the 49ers Respond to the Attack?

The 49ers are fresh off a crushing playoff loss to the Los Angeles Rams.  The team issued a statement in response to the digital attack, noting how it recently discovered a network security breach.  The team didn’t provide many details about the attack yet was willing to admit it disrupted IT network systems.  The team’s representatives stated they reached out to law enforcement and connected with cybersecurity specialists to investigate the matter.
 
The storied franchise issued a statement to address the ransomware attack.  That statement was fairly brief.  The team insists there is no indication that the ransomware attack pertains to systems beyond its corporate network or those tied to ticket holders or the team’s football stadium operations.

What Else is Known About BlackByte?

BlackByte has been in the news of late for all the wrong reasons.  The ransomware specialists were highlighted in a recent public service announcement made by federal government agencies. The United States Secret Service and the FBI notified the public that BlackByte compromised several businesses here in the United States and abroad.  In fact, BlackByte’s attacks have also compromised several of our domestic critical infrastructure sectors dating back to November.
 
The federal government and digital security specialists have made it clear that BlackByte is a ransomware-as-a-service group.  In other words, BlackByte is decentralized in the sense that it had individual hackers operating on its behalf in different locations.  These freelancers create the ransomware, attack targeted organizations, and perform other duties as digital mercenaries. 
 
The evolution of ransomware into a service style attack is concerning as it indicates ransomware specialists are becoming that much more organized as time progresses. The National Security Agency (NSA) also stated that ransomware operators are creating arbitration systems to facilitate timely payments to individual ransomware hackers within overarching networks.

Where is BlackByte Based?

 It is particularly interesting that cyber security specialists who study ransomware have stated BlackByte malware is designed with hardcode that does not encrypt systems that use languages used by the Russians or their allies.  It is possible that BlackByte is based in Russia or one of the country’s allies.  However, threat analysts who have performed a deep dive into the hacking collective’s activities are not completely certain the attack on the 49ers stemmed from Russia.