IT Services Giant Cognizant Hit by Maze Ransomware Cyber Attack

Cognizant Technology Solutions Corp, one among the most important IT services providers hit by Maze Ransomware Cyber Attack which causes service disruptions to its clients.

The company has quite 300,000 employees and it provides IT services, including digital, technology, consulting, and operations services.

Maze Ransomware Attack – Cognizant

The company started emailing their client on Friday, stating that their internal systems hit by Maze ransomware attack.

“Cognizant can confirm that a security incident involving our internal systems, and causing service disruptions for a few of our clients, is that the results of a Maze ransomware attack,” reads the corporate statement.

 High alert associated with the yet one more ransomware attack perpetrated by the Maze group possibly affecting @Cognizant.

 Reviewing & mitigating against the standard Maze TTPs (including RDP + remote services as an attack vector) is advisable.

 ✅Pushed #YARA↘️https://t.co/qcUY464fSf pic.twitter.com/z2zHL5apkm

 — Vitali Kremez (@VK_Intel) April 18, 2020

The company said that they need implemented internal security related to leading cyber defense firms and “taking steps to contain this incident”.

They also engaged with the enforcement authorities, consistent with the statement posted to its website on Saturday.

 – April 11 a threat actor offers to sell access to an enormous IT company for $200,000.

 – April 17th he closes the thread saying it's not relevant anymore.

 – April 18th, Cognizant suffers a Ransomware by Maze.

 Is it possible Maze bought that access and Cognizant was the company? https://t.co/IZlB82Bfd7

 — Under the Breach 🦠 (@underthebreach) April 18, 2020

The company has informed their “clients and have provided them with Indicators of Compromise (IOCs) and other technical information of a defensive nature”.

 Cognizant sending emails to their clients "stating that that they had been compromised" including a hash of a ~fresh Maze ransomware sample then Maze denies it?

 🤔 pic.twitter.com/9AEWWLpg8t

 — MalwareHunterTeam (@malwrhunterteam) April 18, 2020

The maze ransomware was first observed in May 2019, operators behind the maze ransomware are known for stealing unencrypted files before encrypting them.

Then by using the stolen files, the operators will threaten the victims to pay the ransom or they're going to release the info .

Unlike other ransomware operators who use social engineering and spam email campaigns to attack targeted systems, the maze ransomware operators use exploit kits to put the foothold.

“If the Maze operators conducted this attack, they were likely present in Cognizant’s network for weeks, if not longer,” said Bleeping computer, who first reported the incident.

Once the encryption completed each file gets appended with different extension along side the first extension and therefore the desktop wallpaper get’s changed to below.

Maze ransomware developed by skilled developers, they include variety of stealthy mechanisms and it poses an enormous threat to individuals and enterprises.

The ransomware attacks now become a simple and malicious way of robbing individuals and company’s can cost billions of dollars to not mention the privacy and safety implications.