CNA Financial Corp. Paid $40 Million after the Phoenix CryptoLocker Attack

CNA, one of the largest commercial insurers in the U.S. was forced to pay $40 million for its security from the Phoenix CryptoLocker ransomware. It is believed to be the biggest cyberattack ransom paid in history. CNA Financial Corp. is based in Chicago and provides products and services to the United States, Canada, Europe, and Asia.

The attack was carried out in March, which led to the disconnection of CNA’s IT systems from the network to contain the threat and prevent further infection of additional systems. According to Bloomberg, the Phoenix CryptoLocker group is behind this attack. The goal of these cybercriminals is to immediately encrypt as much of the victim’s data as possible and demand a ransom for remediation.

Initially, CNA sought to restore their systems from backups rather than by paying the ransom. But a week later, the company decided to start negotiations with the hackers who demanded $60 million. Apparently, they agreed on a smaller amount and paid it a week after. The representatives of the company do not comment on this event, and only add that “CNA followed all laws and regulations and published instructions during solving this problem.”

Compared to 2019, in 2020 cybercriminals received about $350 million in total, an increase of 311%, according to the Chainalysis report. For example, in a recent attack on Colonial Pipeline, they had to pay $4.4 million. In attacks on Acer and Apple, the ransom amounts were equal to $50 million, but the actual payments are not known. The FBI does not recommend that victims pay such large ransoms, because it does not guarantee the return of data, but only motivates the attackers to request more and more amounts.

Let us take a look at the DarkSide traces and how SpinOne detects the attack.

The files encrypted by the Phoenix CryptoLocker:

After encryption, it leaves a ransom note in the folder with encrypted files:

SpinOne Ransomware Protection successfully detects and stops the attack. Then, SpinOne recovers the encrypted files in the cloud.

The files on Google Drive have been successfully recovered by SpinOne:

Read also:

• https://spin.ai/solutions/ransomware-protection-saas-data/
• https://threatpost.com/cna-hit-novel-ransomware/165044/
• https://www.theverge.com/2021/5/20/22446388/cna-insurance-ransomware-attack-40-million-dollar-ransom
• https://www.zdnet.com/article/ransomware-gangs-made-at-least-350-million-in-2020/
• https://medium.com/spin-ai-ransomware-protection/darkside-ransomware-hit-the-uss-largest-pipeline-175cb3bac7b3
• https://medium.com/spin-ai-ransomware-protection/acer-hit-by-revil-asking-to-pay-50-mln-as-ransom-1175407d686a
• https://medium.com/spin-ai-ransomware-protection/revil-demands-a-ransom-for-not-publishing-apples-classified-data-25cb8c4ae523