View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
April 20, 2020updated 21 Apr 2020 10:08am

IT Services Giant Cognizant Hacked: “Maze” Ransomware Hits Systems

"A security incident involving our internal systems, and causing service disruptions for some of our clients, is the result of a Maze ransomware attack"

By CBR Staff Writer

Another IT services heavyweight has fallen victim to a ransomware attack, with the US’s Cognizant — a $16.8 billion by 2019 revenue stalwart of the Fortune 500 — admitting over the weekend that a “Maze ransomware attack” had hit internal systems and was causing service disruption for clients.

A short statement, published Saturday provides little detail on extent of compromise or how many customers were facing impact.

Among other services, Cognizant provides a wide range of outsourced IT services for the financial services sector — a sector that accounted for over $5.8 billion of its total revenues in 2019. (See chart below).

Cognizant’s 2019 revenues by segment.

The New Jersey-based company said: “Cognizant can confirm that a security incident involving our internal systems, and causing service disruptions for some of our clients, is the result of a Maze ransomware attack.”

Cognizant, which employs around 300,000 people globally, has contacted law enforcement and provided Indicators of Compromise (IoC)s to partners it said, without revealing the initial delivery vector.

Read this: Canada’s Largest Lab Admits Paying Up After Ransomware Attack

The incident comes hot on the heels of a ransomware attack on major UK financial services technology provider Finastra last month; an incident which saw estimated hundreds of millions of dollars in transactions frozen as the company unplugged servers to prevent the ransomware spreading further.

(It has since worked through databases to process payments manually as it restored systems).

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

Spain’s largest IT consultancy, Everis, owned by NTT Data, was also hit by ransomware in November 2019.

Cognizant Hacked: What is the Maze Ransomware?

The cyber criminals behind the Maze ransomware use a range of different techniques to gain entry to the companies it is targeting, including exploits kits, remote desktop connections with weak passwords or sophisticated phishing campaigns. The ransomware itself is sophisticated, with a bag of tricks baked into its code to avoid detection by security programmes.

Those behind the ransomware have pivoted to data theft before encrypting information as leverage to get organisations to pay the ransom and regular leak snippets of stolen files to a dedicated “Maze news” website.

The malware itself is a binary file of 32 bits, usually packed as an EXE or a DLL file, according to a March 2020 McAfee analysis, which noted that the Maze ransomware can also terminate debugging tools used to analyse its behaviour, including the IDA debugger, x32dbg, OllyDbg and more processes, “to avoid dynamic analysis, close databases, office programs and security tools”.

The UK’s NCSC recently warned that diverse forms of online backup are also increasingly being encrypted in ransomware attacks. In a February 2020 warning, the NCSC said that it has seen “numerous incidents where ransomware has not only encrypted the original data on-disk, but also connected USB and network storage drives holding data backups.

“Incidents involving ransomware have also compromised connected cloud storage locations containing backups.”

Has your business been affected by the Cognizant incident? Get in touch with our editor ed (dot) targett (at) cbronline (dot) com .

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.