The NFL's San Francisco 49ers team is recovering from a cyberattack by the BlackByte ransomware gang who claims to have stolen data from the American football organization.
The 49ers confirmed the attack in a statement to BleepingComputer and said it caused a temporary disruption to portions of their IT network.
While the 49ers did not confirm whether hackers successfully deployed the ransomware, they said they are still in the process of recovering systems, indicating that devices were likely encrypted.
To conduct a ransomware attack, threat actors breach a corporate network and silently spread to other devices while stealing data. The hackers ultimately deploy malware that encrypts all of the devices on the network, while leaving ransom notes demanding a cryptocurrency payment to receive a decryptor.
The ransomware gangs then use the stolen files as leverage, threatening to release them if they are not paid a ransom.
The BlackByte gang claimed responsibility for the 49er's attack yesterday, right as the NFL gets ready for Super Bowl 2022, by beginning to leak files that they claim are stolen files.
https://www.bleepstatic.com/images/n...-leak-site.jpg
BlackByte ransomware leaking the San Francisco 49ers' data
The leaked data is a 292MB archive of files that the threat actors say are stolen 2020 invoices from the 49ers' network.
BlackByte usually releases its victims' data in increasing amounts to further pressure the victim into paying.
While it is not known how much data has been stolen during the attack on the 49ers, BlackByte has stolen gigabytes of data from previous victims.
Who is BlackByte?
The BlackByte ransomware operation launched in July 2021 when it began targeting corporate victims worldwide.
The ransomware gang is not particularly active compared to other groups, but they have conducted numerous successful attacks, meaning the enterprise should not ignore them.
https://www.bleepstatic.com/images/n...ansom-note.jpg
Example BlackByte ransom note
The ransomware gang is known to utilize vulnerabilities to gain initial access to a corporate network, illustrating the need to always have the latest software updates installed.
In October 2021, the BlackByte operation made the significant mistake of reusing the same decryption/encryption key in multiple attacks.
While BlackByte quickly fixed the bug, it allowed cybersecurity firm Trustwave to create a free decryptor allowing some victims to recover their files for free.