Cybersecurity Breach: Fsociety Ransomware Attack on SBC Global Services Inc.
Ransomware Attack on SBC Global Services Inc. by Fsociety
Company Profile: SBC Global Services Inc.
SBC Global Services Inc., formerly known as Southwestern Bell Inc. and later SBCGlobal before rebranding to AT&T in 2005, is a key player in the telecommunications sector. Based in San Francisco, California, the company provides a range of services including long-distance voice, data services, and wireline internet across the United States. With a moderate workforce size of 11-50 employees, SBC Global Services Inc. reported a peak revenue of $179.7 million in 2023. The company operates under the domain sbcglobal.net, primarily used for email services integrated with Yahoo.
Details of the Ransomware Attack
The cybercrime group Fsociety has claimed responsibility for a significant data breach targeting SBC Global Services Inc. The attack resulted in the exfiltration of approximately 1 terabyte of confidential information and user data. This data has since been published on Fsociety's dark web leak site, indicating a severe security breach.
Vulnerabilities and Potential Breach Methods
Given the nature of SBC Global Services Inc.'s operations and its reliance on legacy domain systems like sbcglobal.net, the company's cybersecurity defenses might have vulnerabilities typical of older digital infrastructures. These can include outdated security protocols, insufficient segmentation of network resources, or legacy systems that no longer receive regular security updates. Such factors could have provided Fsociety with multiple attack vectors to exploit, such as phishing, exploiting known vulnerabilities, or other forms of social engineering.
Profile of the Attacker: Fsociety
Fsociety is a relatively new player in the realm of cyber threats, first identified in 2016. The group is known for using Python-based ransomware, which is part of the open-source EDA2 project. Their ransomware is capable of infecting network share resources, downloading and executing arbitrary payloads, and includes anti-VM evasion techniques. The group's ability to adapt and modify their attack methods using easily accessible open-source tools makes them particularly dangerous.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!