Olympus has more than 31,000 employees worldwide and over 100 years of history developing for the medical, life sciences, and industrial equipment industries.

The company’s camera, audio recorder, and binocular divisions have been transferred to OM Digital Solutions, which has been selling and distributing these products starting with January 2021.

Customer security not affected by the attack

“Olympus is currently investigating a potential cybersecurity incident affecting limited areas of its EMEA (Europe, Middle East, Africa) IT systems on September 8, 2021,” the company said in a statement published Saturday, three days after the attack.

“Upon detection of suspicious activity, we immediately mobilized a specialized response team including forensics experts, and we are currently working with the highest priority to resolve this issue.

“As part of the investigation, we have suspended data transfers in the affected systems and have informed the relevant external partners.”

Olympus also said that it’s working on discovering the extent of the damage resulting from this attack and will share additional info as soon as it is available.

Christian Pott, company spokesperson responsible for Olympus corporate matters, also told BleepingComputer that customer security and service were not affected by the incident.

“The support, service and security of our customer has the highest priority and is not effected by this case,” an Olympus spokesperson told BleepingComputer when contacted via email.

“Please understand, that we cannot give any further information or statement due to the ongoing process of internal and external investigation.”

About Blackmatter

BlackMatter is a relatively new ransomware operation that surfaced at the end of July 2021 and was initially believed to be a rebrand of DarkSide ransomware.

From samples collected by researchers after some of their subsequent attacks, it was later confirmed that BlackMatter ransomware’s encryption routines were the same custom and unique ones that DarkSide used.

The post Olympus targeted by Blackmatter Ransomware appeared first on CyberHood Sentinel.

After successfully conducting the attack on US Colonial Pipeline DarkSide gang was facing increased scrutiny from international law enforcement and US.

During may the Darkside ransomware has abruptly shutdown its operation after losing access to their servers and cryptocurrency which was seized by an unknown third-party. 

In July a new ransomware operation known as BlackMatter emerged which is actively attacking victims and purchasing network access from other attackers to launch attacks.

Security researchers analyzing the Blakmatter decryptor and concluded that the encryption mechanism used by the BlackMatter is similar to the one used by the DarkSide ransomware gang.

Fabian Wosar told Bleeping computer that the encryption routines used by BlackMatter are pretty much the same, including a custom Salsa20 matrix unique to DarkSide.

When encrypting data using the Salsa20 encryption algorithm, a developer provides an initial matrix consisting of sixteen 32-bit words.

When encrypting files instead of using constant strings, a position, nonce, and key, for each encrypted file, DarkSide fills the words with random data.

This matrix is then encrypted with a public RSA key and stored in the footer of the encrypted file.

Fabian says this Salsa20 implementation was previously only used by DarkSide, and now BlackMatter.

DarkSide used an RSA-1024 implementation unique to their encryptor, which BlackMatter also uses.

While there is not 100% proof that BlackMatter is a rebrand of the DarkSide operation, many similar characteristics make it hard to believe this is not the case.

When we take the same encryption algorithms, the similar language used on the BlackMatter sites, similar craving of media attention, and similar color themes for their TOR sites, it is highly like that BlackMatter is the new DarkSide.

A rebrand from DarkSide also explains the reason the new BlackMatter group won’t target the “Oil and Gas industry (pipelines, oil refineries),” which led to their previous downfall.

Unfortunately, this is a highly skilled group that targets multiple device architectures, including Windows, Linux, and ESXi servers.

Due to this, we will need to keep an eye on this new group as they will surely perform attacks on well-known targets in the future.

The post Darkside Ransomware gang rebranded as BlackMatter Ransomware appeared first on CyberHood Sentinel.