Pierluigi Paganini October 09, 2022

Everest ransomware operators claimed to have hacked South Africa state-owned company ESKOM Hld SOC Ltd.

In March 2022, the Everest ransomware operators published a notice announcing the sale of “South Africa Electricity company’s root access” for $125,000.

Eskom transforms inputs from the natural environment – coal, nuclear, fuel, diesel, water, and wind – into more than 90% of the energy supplied to a wide range of customers in South Africa and the Southern African Development Community (SADC) region.

Eskom is one of the few remaining vertically integrated utilities connected to the Southern African Power Pool (SAPP) through an interconnected grid, which serves to support grid stability.

At the time, the company denied having suffered a security breach:

This week, security experts reported that ESKOM Hld SOC Ltd was having some server issues. At the same time, the Everest Ransom gang posted a claim about the hack of the South African state-owned electricity company.

The threat actors claim to have had access to all servers of the company and to have
root access to many of them.

“Administration servers, Databases, backups, employee access to the administration of POS terminals and much more. Multiple settings and developments. You can become the king of electricity the whole country. Trust access of a well-known defense company from USA, which is a partner of this Electric Company.” reads the message published on the Tor leak site of the gang.

The ransomware gang is offering a package including servers with administrator, root, sysadmin passwords for Linux and Windows servers, and more.

The criminals are demanding $200,000 for the stolen access, they accept both Bitcoin and Monero cryptocurrencies.

Price 200,000 $

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, ESKOM)

[adrotate banner=”5″]

[adrotate banner=”13″]