The News: A recent Tesla foiled ransomware attempt included FBI involvement and led to an arrest. Elon Musk commented that the attempt was “serious,” as the ransomware attempt was at his car manufacturer’s massive factory near Reno, Nevada. More details at TechCrunch.
Analyst Take: The Gigafactory in Sparks, Nevada makes battery cells, packs and electric motors for Tesla, Elon Musk’s electric car line. The attempt was reportedly made via an outsider trying to bribe a company employee to make the attack internally.
An unnamed employee at the Gigafactory met with Russian national Egor Igorevich Kriuchkov, who offered to pay the employee up to $1 million dollars to install malware on Tesla’s network that would be used to ransom its data for millions of dollars. The employee informed Tesla, which then notified the Federal Bureau of Investigation. The FBI used the employee in a sting operation and Kriuchkov was arrested on August 22.
The malware was designed to install ransomware, a kind of malware that encrypts a victim’s files in exchange for a ransom. Prosecutors say the ransomware used is an increasingly popular new tactic that not only encrypts a victim’s files, but also exfiltrates the data to the hacker’s servers. The hackers typically threaten to publish the victim’s files if the ransom isn’t paid. This is similar to the REvil attack that occurred recently kind of hack that occurred recently at Jack Daniel’s parent company, Brown-Forman.
This attempted insider ransomware attack against such a prominent company shows just how bold ransomware cyber gangs are becoming. It also shows how much money they have to throw around if they are willing to bribe an employee with $1 million if it stands make them millions more. In his conversations with the FBI says Kriuchkov noted that the group he works has negotiated ransoms up to $6 million.
Though recruitment and bribery can be common in cyber-crime, it is rare in terms of ransomware, which is usually done remotely. The Tesla attack serves as a cautionary tale for CISOs and cyber security teams who spend so much time trying to thwart malicious attacks from the outside world — they equally need to be on the lookout for internal attacks. This means a shift in thinking and keeping track of anomalies in internal operations and any strange behavior demonstrated by employees that might be associated with a cyber threat, like trying to access data that they are usually not privy to. As offices will now be a blended environment, where employees will be coming and going throughout various days of the week, these precautions will be even more crucial.
Futurum Research provides industry research and analysis. These columns are for educational purposes only and should not be considered in any way investment advice.
Other insights from the Futurum team:
REvil Ransomware Breach Targets Jack Daniel’s Parent Brown-Forman — Steals 1 TB of Data
Garmin Cyber-attack Garners Up To $10 Million Ransom To Hackers
What the Massive Twitter Hack Means for CISOs and Security Vendors
