More Toll, F&P Appliances files dumped online - and a warning

Image / 123rf

The Nefilim ransomware gang has published more files from recent victims Toll Group and Fisher & Paykel appliances.

Brett Callow, a threat-assessment analyst with anti-virus and anti-malware company Emsisoft, told the Herald that ransomware gangs often place selected files on the dark web - in up to eight instalments - in a bid to pressure a victim into paying a ransom.

Toll and F&P Appliances (and another recent victim, Lion) all told the Herald last week that their systems had been restored following recent ransomware attacks. None had entered negotiations with their attackers.

The data dump overnight was the second instalment of Toll files to be made public on the web.

The second tranche of F&P Appliances data to be published includes more than 500 financial and planning files.

The first tranche last month included an expenditure vs budget spreadsheet and a China Business Unit Report presentation, both dated January 2020, and a China Manufacturing Review spreadsheet dated March 2020. All were multi-page and densely packed with financial data and various metrics, according to a security consultant who viewed them.

Anyone could take a peek but think twice. Beyond receiving stolen files, you could also be downloading booby-trapped files.

CERT NZ deputy director Declan Ingram earlier warned that ransomware gangs often plant malware in returned files - the better to open the way to a fresh attack (which also serves as another good reason not to pay a ransom).

Australia and New Zealand have both announced boosts for government-backed efforts to help protect both Crown agencies and private enterprise from cyber attacks - albeit with the budget boost across the Tasman dwarfing NZ's.

What to do if you're hit by ransomware

New Zealand businesses or individuals hit by a cyber-attack are advised to contact Crown agency CERT (the Computer Emergency Response Team) as their first step.

CERT acts as a triage unit, pointing people to the right law enforcement agency or technical contacts.

CERT director Rob Pope and police both advise against paying up on a ransomware demand, even if the sum involved is modest.

They say there is no guarantee that data will be returned, or unlocked. They also caution that while paying a small ransom can be convenient, the money can help fund Eastern European gangs who are also involved in the likes of drug and human trafficking.

CERT's recommended precautions against ransomware include encouraging staff to question any communication that could be a phishing attack (an attempt to imitate a legitimate company to gain details about a person or organisation) and doing a "cold backup" or an old-fashioned backup to a hard drive, which is then stored off-premise, as well as using cloud services for backup.