Two unnamed Manitoba, Canada law firms have been hit by a Maze ransomware attack which has locked their computers and their cloud backup. 

According to the Law Society of Manitoba, as a result of the virus attack, the law firms have no access to email, Word, accounting software, or any backups, including cloud backups.

Both firms have been asked to pay an enormous ransom to regain access to any of their work. The firms are working with IT professionals and cyber insurers and still are not sure how the virus took hold. "We suspect that someone clicked on a link or an attachment in an email that was infected with a virus which in turn infected the firms’ entire systems. At this point, we do not know when or if they will ever regain complete access to their kidnapped data," adds the Law Society of Manitoba.  

Recently, notes the Law Society of Manitoa, the infected attachments appear to have been about COVID-19 including:

• Emails with a COVID-19 outbreak maps in an attachment.
• Emails inviting you to a seminar to discuss responses to COVID-19, which includes a link to register for the seminar.
• Emails claiming to be from vendors or associations about COVID-19 that include links to PDFs and Word documents.
• SMS (text) messages, indicating you need to “click here” to find out about modified firm operations.

Chris Morales, head of security analytics at Vectra, says, “Ransomware attacks have pivoted to data theft before encrypting information as leverage to get organizations to pay the ransom. In particular, the Maze ransomware ring has begun publicly posting breached data on the Internet and threatening full dumps of stolen data if victims don't pay for their files to be unencrypted. Maze has posted on their “Mazenews” site alleged stolen data from victim organizations around the word, from many different industries – including multiple legal professional service providers."

"The Maze ransomware is not the only one now using stolen data as additional leverage to get victims to pay up," warns Morales. "The REvil/Sodinokibi ransomware operators have also threatened to reveal data of victims who don't pay, including the travelers’ financial service provider Travelex. These coercion tactics are making ransomware attacks even more expensive."

Ransomware is an insidious threat spreading virulently at machine speed across the victim’s internal networks, and there are no perfect defences. To exfiltrate information, attacks target and leverage privileged entities due to the unfettered access they can provide," adds Morales. Escalation from a regular user account to a privileged account is a critical step for the attackers on their way towards their goal. Privileged entities are not just limited to accounts, but also hosts and services within the network environment.  With these type of high velocity attacks, time is the defending security team’s most precious resource. Early detection and response can make the difference between a contained, minimized incident or the situation of facing massive business disruption and costs.”