French IT services giant Sopra Steria said today in an official statement that the October Ryuk ransomware attack will lead to a loss of between €40 million and €50 million.

Sopra Steria is a European information technology firm with 46,000 employees in 25 countries providing a large array of IT services, including consulting, systems integration, and software development.

“The remediation and differing levels of unavailability of the various systems since 21 October is expected to have a gross negative impact on the operating margin of between €40 million and €50 million,” Sopra Steria said. “The Group’s insurance coverage for cyber risks totals €30 million.”

Read more »

Why ISPs?

1. Protecting ISPs is today an high priority from a nation’s national security perspective.

2. Internal research activities have shown that all the ISP-related intrusions that are attributable to organized adversaries (or APT) are aimed at digital espionage operations towards third parties or at  accessing customer data / database.

3. In 2019 there has been an increase in activities against this sector by threat groups suspected by industry of operating on behalf of the China, Russia and the DPRK interests. Locally, activities in the Middle-East have been observed by groups suspected of operating on behalf of the Iranian government.

4. In 2019, I participated in the analysis of “DeadlyKiss”. According to what observed, it’s an uncommon piece of malware family active since at least 2016. Its victims appears to be exclusively entities operating in the telecommunications sector. The ability of this threat to remain so in the shadows for all these years (prior to publication its detection rate was extremely low with only one vendor able to
detect it via ML algorithms) makes us reflect on how some threat actors can use specific digital weapons exclusively for the compromise of specific sectors / targets.

Read more »