French IT Giant Sopra Steria Hit By Ryuk Ransomware

French IT services giant Sopra Steria suffered a cyberattack on October 20th, 2020, that reportedly encrypted portions of their network with the Ryuk ransomware.

Sopra Steria is a European information technology company with 46,000 employees in 25 countries worldwide. The company provides a wide range of IT services, including consulting, systems integration, and software development.

On October 21st, Sopra Steria issued statement that they had suffered a cyberattack on the evening of October 20th, but provided few details about the attack.

“A cyberattack has been detected on Sopra Steria’s IT network on the evening of 20th October.

Security measures have been implemented in order to contain risks.

The Group’s teams are working hard for a return to normal as quickly as possible and every effort has been made to ensure business continuity.

Sopra Steria is in close contact with its customers and partners, as well as the competent authorities.”

Also Read: Thinking of Shredding or Burning Paper? Here’s What You Should Know

Reported Ryuk ransomware attack

A source familiar with the attack has told BleepingComputer that the Sopra Steria network was encrypted by Ryuk ransomware, the same group that infected the Universal Health Services.

Numerous sources have also told the French IT website LeMagIT that it was Ryuk ransomware threat actors who were behind the attack.

This hacking group is known for its TrickBot and BazarLoader infections that allow threat actors to access a compromised network and deploy the Ryuk or Conti ransomware infections.

BazarLoader is increasingly being used in Ryuk attacks against high-value targets due to its stealthy nature and is less detected than TrickBot by security software.

When installed, BazarLoader will allow threat actors to remotely access the victim’s computer and use it to compromise the rest of the network.

After gaining access to a Windows domain controller, the attackers then deploy the Ryuk ransomware on the network to encrypt all of its devices, as illustrated in the diagram above.

Also Read: What Legislation Exists in Singapore Regarding Data Protection and Security?

When we reached out to Sopra Steria for further confirmation, we were told that they “don’t have further details to share.”