🖧 Post 3/2025: News Update- Ransomware attack on
Tata Technologies.
A subsidiary of Tata Motors, Tata
Technologies is an Indian public multinational tech firm that focuses on
automotive design, aerospace engineering, and R&D engineering in general.
Tata Tech in a notification to National
Stock Exchange notified that a ransomware has temporarily affected some of the data/ IT
assets. This attack was reportedly carried out in January 2025
The public notice issued by Tata
Tech intimates about Cyber Security Incident. (Image of the public notice is attached below.)
A ransomware group known as
Hunters International added Tata to their Tor-based leak site, claiming to have
stolen over 730,000 files and threatening to make all the data public within
the next six days.[1]
(This notorious group has targeted
organizations working in sectors of automotive, financial, manufacturing, etc. One
of the major targets of this group was the U.S. Navy Contractor ‘Austal USA’)
With no further updates have been
shared by the company for over a month, Hunters International added an entry of
Tata Technologies on its extortion page on the dark web, claiming
responsibility for the attack. The threat actors claim to have stolen 1.4TB of
data from Tata Technologies, consisting of 730,000 files. The ransomware gang
threatens to release the stolen files in exactly one week if a ransom
demand is not met.[2]
What is a ransomware attack?
Ransomware is a type of malware. It
holds the target’s data as hostage and threatens to keep it locked unless a ‘ransom’
amount is paid to the attacker.
During earlier times, which
technological advancements were not at their peak, the ransomware attacks were
simple- a ransom in exchange of an encryption key that is used for regaining of
the hostage data/infected data/device.
One of the major reasons of data
breach is a ransomware attack. Some statistics by IBM regarding the ransomware
attacks are as follows:
- ·
20% of all cyberattacks recorded by
the IBM® X-Force® Threat Intelligence Index in 2023
involved ransomware. And these attacks move quickly. When hackers gain
access to a network, it takes less than four days to deploy ransomware. - · According to the IBM Cost of a Data
Breach report, the average cost of a ransomware breach is USD
5.68 million, which does not include ransom payments.
Common methods of deploying a
ransomware includes-
Phishing, social
engineering techniques, software vulnerabilities, Drive-by-downloads
(showing malwares as legitimate so that the user downloads it and the ransomware
gets injected into the device.), Ransomware-as-a-service (RaaS) is one of the
major deployed technique (the ransomware developers share the malware code with
the cybercriminals).
Process of Injecting a ransomware-
Initial Access through Phishing/software vulnerabilities, etc. 🠖 Deploying an intermediary access tool so as to gain the hold of the target device 🠖 Lateral Movement where the attackers start gaining access to systems and domains 🠖 Data Collection where the attackers identify the valuable data 🠖 Backing up the target’s data and the ask for a Ransom.
📎
YLTB! 
Leave a comment