Foxconn is facing a ransom demand of 1,804 bitcoin ($34 million).

A Mexican office of Foxconn Technology Co Ltd (TPE: 2354), the electronics behemoth that makes products for Apple (NASDAQ: AAPL) was the victim of a ransomware cybersecurity attack on November 29. According to Bleeping Computer, the Doppelpaymer gang mounted the attack on Foxconn’s Mexican branch. (Bitcoin.com)

What the Ransomware Doppelpaymer gang says

To Bleeping Computer: “We encrypted NA segment, not whole Foxconn, it’s about 1200-1400 servers, and not focused on workstations. They also had about 75TB’s of misc backups, what we were able to – we destroyed (approx 20-30TB).”

Reportedly, on November 29, the gang made off with some unencrypted files before encrypting devices in Foxconn’s facility at Ciudad Juarez.

The bad actors have demanded about $34 million as ransom, payable in bitcoin.

What Foxconn says

The company said on December 8: “We can confirm that an information system in the US that supports some of our operations in the Americas was the focus of a cybersecurity attack on November 29. We are working with technical experts and law enforcement agencies to carry out an investigation to determine the full impact of this illegal action and to identify those responsible and bring them to justice.”

Ransomware attackers upping the ante

Just before Thanksgiving, hackers hit a school district in Maryland with a ransomware attack, shutting down classes for more than 115,000 students. Though the school district has not revealed much information about the incident, it described it as a “catastrophic attack on our technology system”.

Last week, the Black Shadow ransomware group attacked Israeli insurer Shirbit’s IT infrastructure. The hackers demanded a ransom of 200 bitcoin, or about $3.8 million.

Defenders under threat – FireEye also a victim

A state sponsor allegedly breached FireEye (NASDAQ: FEYE), one of the largest cybersecurity outfits in the U.S., in one of the most significant attacks in recent history.

The company confirmed the attack on Tuesday. It said certain hacking tools used to test clients’ defenses (“red team tools”) had been stolen.

According to VentureBeat, FireEye said the hack was the handiwork of a rogue state.

FireEye may have attracted the criminals because it has a trove of government agencies as clients.

What’s interesting is what FireEye said in a blog:

• We are witnessing an attack by a nation with top-tier offensive capabilities.
• The attackers tailored their world-class capabilities specifically to target and attack FireEye.
• They are highly trained in operational security and executed with discipline and focus.
• The gang operated clandestinely, using methods that counter security tools and forensic examination.
• They used a novel combination of techniques not witnessed by us or our partners in the past.

Related Story:  Dragos Scores $110M For Cybersecurity Of Industrial Control Systems And Operational Technology