A Cyberattack Allegedly Knocked Insurance Giant CNA Offline

[mood]

A Cyberattack Allegedly Knocked Insurance Giant CNA Offline

 

Photo: KIRILL KUDRYAVTSEV/AFP (Getty Images)

 

CNA Financial, one of the largest insurance providers in the U.S., is currently experiencing widespread network disruptions.

 

The company’s website isn’t working, nor can its phone lines be reached. Employee services have been down for at least 48 hours, said a source close to the company. Sources suggest that the firm has been hit with a cyberattack, potentially a ransomware situation.

 

On the company’s website, a banner simply reads: “CNA is currently experiencing a network disruption that is impacting some of our systems. We are working to address these issues to minimize the disruption to you.”

 

According to The Insurer, an insurance industry news outlet, the company’s network may be out for a while:

 

CNA Financial Corporation’s website and some systems are down amid suggestions the Chicago-headquartered insurer has been hit with a suspected cyber attack with the incident understood to have caused disruption on the underwriting and claims side of its business.

 

If that is, indeed, what has occurred, one factor that makes this incident potentially more concerning than your average cyberattack is the fact that CNA is one of the larger providers of cyber insurance in the country. Oft touted as a way to protect businesses, in a case like this cyber insurance might have the exact opposite effect.

 

Joshua Motta, CEO of security firm Coalition, said that a hack like this is a “nightmare scenario” and could involve a hacker getting their hands on cyber insurance policyholder data. That data would give a hacker exact information on how much money policyholders are capable of paying out in the event of a future attack. Usually, ransomware hackers must make educated guesses about how much a company can shell out to get their data back, and a company can always claim that it doesn’t have the money—a crucial bargaining chip for the victim. With CNA’s insurance data, however, that bargaining chip would be gone—and hackers could conduct much more efficient attacks.

 

Again, this is all speculative—though it certainly would appear something significant has happened to CNA. When reached by phone Tuesday, a company representative couldn’t immediately provide information on what had occurred. We will update this story if more information becomes available.

 

 

Source: A Cyberattack Allegedly Knocked Insurance Giant CNA Offline

[mood]

Insurance giant CNA hit by new Phoenix CryptoLocker ransomware

 

 

Insurance giant CNA has suffered a ransomware attack using a new variant called Phoenix CryptoLocker that is possibly linked to the Evil Corp hacking group.

 

This week, BleepingComputer reported that CNA had suffered a cyberattack impacting their online services and business operations.

 

CNA website outage caused by the ransomware attack

 

Soon after we reported on the attack, CNA issued a statement confirming that they had suffered a cyber attack last weekend.

"On March 21, 2021, CNA determined that it sustained a sophisticated cybersecurity attack. The attack caused a network disruption and impacted certain CNA systems, including corporate email," CNA disclosed in a statement.

If you have first-hand information about this or other unreported cyberattacks, you can confidentially contact us on Signal at +16469613731 or on Wire at @lawrenceabrams-bc.

CNA hit by a ransomware attack

Since our first reporting, BleepingComputer has confirmed that CNA suffered an attack by a new ransomware known as 'Phoenix CryptoLocker.'

 

Sources familiar with the attack have told BleepingComputer that the threat actors deployed the ransomware on CNA's network on March 21, where it proceeded to encrypt over 15,000 devices on their network.

 

BleepingComputer has learned that it also encrypted the computers of employees working remotely who were logged into the company's VPN at the time of the attack.

 

When encrypting devices, the ransomware appended the .phoenix extension to encrypted files and created a ransom note named PHOENIX-HELP.txt, as shown below.

 

Ransom note created during CNA ransomware attack

 

BleepingComputer was further told that CNA would be restoring from backups but has not confirmed that with the company.

Possible links to Evil Corp

A source has told BleepingComputer that Phoenix Locker is believed to be a new ransomware family released by Evil Corp based on similarities in the code.

 

Evil Corp historically used the WastedLocker ransomware when conducting attacks against compromised organizations.

 

Since the US government sanctioned the hacking group in 2019, most ransomware negotiation firms would no longer facilitate WastedLocker ransom payments to avoid facing fines or legal action.

 

According to a recent CrowdStrike report, the Evil Corp hacking group switched to a new ransomware family called Hades to bypass the US sanctions.

 

Hades Tor site

 

The new Hades ransomware family has been seen in multiple attacks since then, including a ransomware attack on trucking giant Forward Air.

 

However, CrowdStrike's analysis has shown that Hades is simply a rebranded version of their previously used WastedLocker ransomware.

 

The new Phoenix Locker ransomware used in the CNA attack is believed to be another Evil Corp spinoff.

 

When BleepingComputer asked CNA about a connection between the sanctioned Evil Corp and the Phoenix group, they replied that there was no confirmed nexus.

 

"The threat actor group, Phoenix, responsible for this attack, is not a sanctioned entity and no U.S. government agency has confirmed a relationship between the group that attacked CNA and any sanctioned entity. We have notified the FBI of this incident and are actively cooperating with them as they conduct their investigation of the incident."

Cyberinsurance companies are a valuable target

The attack on CNA could have tremendous impact on other companies, especially those that have cyberinsurance policies through the company.

 

Conducting attacks on companies with cyberinsurance policies are often lucrative for ransomware gangs as the insurance companies may be more likely to pay the ransom.

 

There could be no better way to create a list of insured companies to target than to hack an insurer's network and steal policy information about their customers.

 

Using this information, a ransomware operation can create a list of insured companies and their policy limits. The ransomware operators could then create ransom demands tailored around a particular victim's policy coverage.

 

At this time, it is not known if the threat actors stole unencrypted files before encrypting CNA's devices.

 

However, stealing unencrypted data has become a common tactic used by ransomware operations, so it is likely that some data was stolen during the attack.

 

 

Source: Insurance giant CNA hit by new Phoenix CryptoLocker ransomware