Ransomware gang wants apple to "buy back" stolen blueprints [Update]

Ransomware gang wants apple to "buy back" stolen blueprints [Update]

A notorious Russian ransomware and data theft ring is demanding Apple pay millions of dollars or release blueprints and schematics of Apple products.

The REvil group, known for its Sodinokibi ransomware, has allegedly infiltrated the servers of Quanta Computer, a Taiwanese company that reportedly manufactures and assembles hardware for Apple, Dell, HP, Lenovo, and many other technology companies. The company claims to have hacked into and encrypted [Update: Dell says it has nothing to do with Quanta, and REvil's "Happy Blog" has added a schematic of an iMac featured in an April 20 Apple presentation.]

REvil is notorious for stealing data from victims before encrypting it on their servers. If the ransom for decryption is not paid, they threaten to release the stolen data. Past victims have included the owner of the Ritz Hotel in London, a Jack Daniels whiskey distillery, and even a well-known law firm.

Tom's Guide has reached out to Apple for comment. [Yesterday (April 20), just before Apple's own "Spring Loaded" product launch event, the REvil Group wrote in a blog post, "Without waiting for future Apple announcements, today we at the REvil Group will provide data on upcoming releases from the much-loved company." The company declared.

"Tim Cook can say thank you to Quanta," the blog post added." Our team is negotiating the sale of a large amount of confidential drawings and gigabytes of personal data with several major brands . We recommend that Apple buy back any available data by May 1."

"We are also working on a plan to sell the data to the U.S. government,"

the blog post added.

It is unclear how much the gang is demanding from Apple, but the group is demanding a $50 million ransom from Quanta Computer.

Recorded Future threat analyst Dmitry Smilyanets told The Record that this may be the first time a ransomware group has demanded money from customers of hacked companies.

Quanta Computer admitted to Bloomberg that although "a small number of Quanta's servers were cyber-attacked," "there was no material impact on the company's business operations."

Tom's Guide obtained the REvil gang's "Happy Blog." (Sorry, we do not link to this blog.)

The latest post contains about 20 JPEG images of what appears to be an assembly drawing of an Apple MacBook laptop. The blog states that "more files are added daily" and that PDF versions of the images are available.

Update: The blog has added 11 more images. All relate to the new iMac M1 line announced at Apple's presentation on April 20. Since these images are mostly about manufacturing tolerances and part numbers for hardware assemblers, it is hard to see why Apple would want to pay to keep these images secret.

One image shows what appears to be the layout of a laptop's logic board, or motherboard. A text box in the image states that the schematic is the property of Apple, is dated "03/09/21," and the designer is "John Andreadis." Another image is a screenshot of the laptop camera schematic, viewed through a Russian-language PDF editor.

We were unable to determine exactly which model this laptop is, but judging from the teensy logic board for the M1 chip that Apple showed off in yesterday's presentation, this laptop requires a larger logic board with a more likely to use a higher power-consuming Intel chip.

Although the blog post does not mention a ransom amount, Bleeping Computer found a Tor site that appears to be a ransom note from the REvil gang against Quanta Computer. It demands $50 million in Monero cryptocurrency by April 27 to decrypt locked files, after which the ransom amount rises to $100 million.

According to Bleeping Computer, Quanta Computer refused to pay the ransom. However, Bleeping Computer also viewed a chat conversation on the REvil payment site, where "all Apple device drawings, all personal data of employees and customers will be released with subsequent sales" unless Quanta resumes ransom negotiations. He stated that the gang had stated.

After the three-hour negotiation deadline passed, Apple's schematics were posted on the Happy Blog.

The Register noticed some oddities in REvil's blog post. Along with the Apple Watch, Apple MacBook Air, and Apple MacBook Pro, the ThinkPad Z60m, a Lenovo laptop that debuted in 2006, was listed as an example of a product manufactured by Quanta Computer.

Quanta Computer's customers were also listed as including Blackberry and Sun Microsystems, although the Register noted that these companies have not manufactured hardware for several years. The customer list appears to have been copied directly from Quanta Computer's Wikipedia entry.

.

Categories