California IT service provider Synoptek pays ransom after Sodinokibi attack

Synoptek, A California-based IT service provider decided to pay the ransom to decrypt its files after being infected with the Sodinokibi ransomware.

Synoptek, a California-based provider of IT management and cloud hosting services paid the ransom to decrypt its files following a Sodinokibi ransomware attack.

The gang behind the Sodinokibi ransomware has been very active in the US in recent weeks, in December, CyrusOne, one of the major US data center provider, was hit by the same ransomware.

Synoptek has more than 1,100 customers across multiple industries, including local governments, financial services, healthcare, manufacturing, media, retail and software.

The infection took place on December 23, the hackers first compromised the company network then installed the ransomware.

“News of the incident first surfaced on Reddit, which lit up on Christmas Eve with posts from people working at companies affected by the outage.” reads the post published by Krebsonsecurity. “The only official statement about any kind of incident came late Friday evening from the company’s Twitter page, which said that on Dec. 23 it experienced a “credential compromise which has been contained,” and that Synoptek “took immediate action and have been working diligently with customers to remediate the situation.”

The IT service provider confirmed the attack but did not comment on whether it paid the ransom asked by the crooks.

“On Dec. 23, we experienced a credential compromise which has been contained,” Synoptek wrote in a Tweet just before 6 p.m. ET Friday. “We took immediate action and have been working diligently with customers to remediate the situation.”

Synoptek CEO Tim Britt told CRN in an email that the “holiday attack” impacted only some of Synoptek’s 1,178 customers. Britt proudly announced that its staff has contained the threat on Christmas Day and it has remediated a vast majority of customer situations before the start of business on Dec. 26.

The Sodiniokibi gang seems to focus on targeting US IT providers, in August 2019 the company PercSoft was infected with the malware, and in December the malware has infected systems at Complete Technology Solutions.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Sodiniokibi, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.