Cybersecurity Breach: Fsociety Ransomware Attack on SBC Global Services Inc.
Incident Date:
May 4, 2024
Overview
Title
Cybersecurity Breach: Fsociety Ransomware Attack on SBC Global Services Inc.
Victim
SBC Global Services Inc.
Attacker
Flocker
Location
First Reported
May 4, 2024
Ransomware Attack on SBC Global Services Inc. by Fsociety
Company Profile: SBC Global Services Inc.
SBC Global Services Inc., formerly known as Southwestern Bell Inc. and later SBCGlobal before rebranding to AT&T in 2005, is a key player in the telecommunications sector. Based in San Francisco, California, the company provides a range of services including long-distance voice, data services, and wireline internet across the United States. With a moderate workforce size of 11-50 employees, SBC Global Services Inc. reported a peak revenue of $179.7 million in 2023. The company operates under the domain sbcglobal.net, primarily used for email services integrated with Yahoo.
Details of the Ransomware Attack
The cybercrime group Fsociety has claimed responsibility for a significant data breach targeting SBC Global Services Inc. The attack resulted in the exfiltration of approximately 1 terabyte of confidential information and user data. This data has since been published on Fsociety's dark web leak site, indicating a severe security breach.
Vulnerabilities and Potential Breach Methods
Given the nature of SBC Global Services Inc.'s operations and its reliance on legacy domain systems like sbcglobal.net, the company's cybersecurity defenses might have vulnerabilities typical of older digital infrastructures. These can include outdated security protocols, insufficient segmentation of network resources, or legacy systems that no longer receive regular security updates. Such factors could have provided Fsociety with multiple attack vectors to exploit, such as phishing, exploiting known vulnerabilities, or other forms of social engineering.
Profile of the Attacker: Fsociety
Fsociety is a relatively new player in the realm of cyber threats, first identified in 2016. The group is known for using Python-based ransomware, which is part of the open-source EDA2 project. Their ransomware is capable of infecting network share resources, downloading and executing arbitrary payloads, and includes anti-VM evasion techniques. The group's ability to adapt and modify their attack methods using easily accessible open-source tools makes them particularly dangerous.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.