{"id":421,"date":"2017-06-20T14:12:52","date_gmt":"2017-06-20T14:12:52","guid":{"rendered":"https:\/\/eset-blog.aist.fun\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/"},"modified":"2019-05-29T12:06:18","modified_gmt":"2019-05-29T12:06:18","slug":"web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/","title":{"rendered":"Web-hosting firm agrees to pay over $1 million to ransomware extortionists"},"content":{"rendered":"

Nayana, a South Korean web hosting firm, was hit hard by a ransomware attack<\/a> earlier this month which hit over 153 of its Linux servers, and impacting over 3,400 websites the company hosts for its business customers.<\/p>\n

Nayana\u2019s systems are thought to have been hit by a Linux variant of the Erebus ransomware, designed to encrypt files on web servers and demand a payment for the data\u2019s safe return. In all, Erebus hunts for 433 different file types on web servers \u2013 including documents, databases, images and videos.<\/p>\n

Two weeks later, Nayana is still attempting to recover normal operations for its customers and has been posting updates on its forum detailing its progress.<\/p>\n

Initially, the criminals behind the ransomware attack demanded 550 Bitcoins (approximately US $1.6 million):<\/p>\n

\n

My boss tell me, you buy many machine, give you a good price 550 BTC
\nIf you do not have enough money, you need make a loan<\/p>\n

You company have 40+ employees, every employee\u2019s annual salary $ 30,000
\nall employees 30,000 * 40 = $ 1,200,000
\nall server 550BTC = $ 1,620,000<\/p>\n

If you can not pay that, you should go bankrupt.
\nBut you need to face your child, wife, customers and employees.
\nAlso, you will lose your reputation, business.
\nYou will get many more lawsuits.<\/p><\/blockquote>\n

After some negotiation<\/a>, however, the ransom demand was reduced to 397.6 Bitcoins (a little more than US $1 million).<\/p>\n

\"\"<\/p>\n

Of course, even that is a considerable amount of money for a victim of a cybercrime to pay out. Because of a lack of available funds, Nayana has agreed with the blackmailers to pay the ransom in three installments and \u2013 according to ZDNet<\/em><\/a> \u2013 lent shares in Nayana to a firm which has previously been interested in acquiring the web-hosting business.<\/p>\n

Obviously, questions must be asked as to why Nayana had to resort to paying criminals for the safe return of its data, and why it felt it wasn\u2019t in a position to restore customers\u2019 servers from secure backups in a timely fashion instead.<\/p>\n

But more than that there remains the question of just how<\/em> Nayana\u2019s servers managed to be compromised so thoroughly. Researchers at Trend Micro report<\/a> that Nayana\u2019s Apache web servers appear to have been left unpatched for years, leaving them vulnerable to exploitation via well-known security holes that could have given an attack root access.<\/p>\n

Whether that is the route through which Erebus managed to sneak its way onto Nayana\u2019s systems with such dramatic effect is uncertain, but what is clear is that if any company leaves itself unpatched and unprotected it is constantly in danger of being attacked again and again and again.<\/p>\n

Ransomware isn\u2019t going away. It\u2019s one of the most effective ways for online criminals to make themselves a fortune. Ensure that you are properly protecting the computers you are responsible for, making regular secure backups, and deploying layered security measures to reduce the risk.<\/p>\n

Source: WeLiveSecurity<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Nayana, a South Korean web hosting firm, was hit hard by a ransomware attack earlier this month which hit over 153 of its Linux servers, and impacting over 3,400 websites the company hosts for its business customers. Nayana\u2019s systems are thought to have been hit by a Linux variant of the Erebus ransomware, designed to<\/p>\n","protected":false},"author":5,"featured_media":1820,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[147,153,167,170],"tags":[],"class_list":["post-421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybercrime","category-hacking","category-privacy","category-small-business"],"acf":[],"yoast_head":"\nWeb-hosting firm agrees to pay over $1 million to ransomware extortionists - ESET Eesti Blogi<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Web-hosting firm agrees to pay over $1 million to ransomware extortionists\" \/>\n<meta property=\"og:description\" content=\"Nayana, a South Korean web hosting firm, was hit hard by a ransomware attack earlier this month which hit over 153 of its Linux servers, and impacting over 3,400 websites the company hosts for its business customers. Nayana\u2019s systems are thought to have been hit by a Linux variant of the Erebus ransomware, designed to\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/\" \/>\n<meta property=\"og:site_name\" content=\"ESET Eesti Blogi\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.com\/antiviirus\" \/>\n<meta property=\"article:published_time\" content=\"2017-06-20T14:12:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-05-29T12:06:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/nayana-623x425-623x425.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"623\" \/>\n\t<meta property=\"og:image:height\" content=\"425\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"ESET Blog\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ESET Blog\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/\"},\"author\":{\"name\":\"ESET Blog\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#\\\/schema\\\/person\\\/876cf293277fc0b2ae2f4395fffe4c88\"},\"headline\":\"Web-hosting firm agrees to pay over $1 million to ransomware extortionists\",\"datePublished\":\"2017-06-20T14:12:52+00:00\",\"dateModified\":\"2019-05-29T12:06:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/\"},\"wordCount\":482,\"image\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/nayana-623x425-623x425.jpg\",\"articleSection\":[\"cybercrime\",\"hacking\",\"privacy\",\"small business\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2017\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/\",\"url\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/\",\"name\":\"Web-hosting firm agrees to pay over $1 million to ransomware extortionists - ESET Eesti Blogi\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/nayana-623x425-623x425.jpg\",\"datePublished\":\"2017-06-20T14:12:52+00:00\",\"dateModified\":\"2019-05-29T12:06:18+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#\\\/schema\\\/person\\\/876cf293277fc0b2ae2f4395fffe4c88\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#primaryimage\",\"url\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/nayana-623x425-623x425.jpg\",\"contentUrl\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/nayana-623x425-623x425.jpg\",\"width\":623,\"height\":425},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Web-hosting firm agrees to pay over $1 million to ransomware extortionists\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/\",\"name\":\"ESET Eesti Blogi\",\"description\":\"Uudised IT maailmast\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#\\\/schema\\\/person\\\/876cf293277fc0b2ae2f4395fffe4c88\",\"name\":\"ESET Blog\",\"sameAs\":[\"http:\\\/\\\/eset.ee\"],\"url\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/author\\\/allankinsigo\\\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2017\\\/06\\\/20\\\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\\\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"ESET EESTI\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Web-hosting firm agrees to pay over $1 million to ransomware extortionists - ESET Eesti Blogi","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/","og_locale":"en_US","og_type":"article","og_title":"Web-hosting firm agrees to pay over $1 million to ransomware extortionists","og_description":"Nayana, a South Korean web hosting firm, was hit hard by a ransomware attack earlier this month which hit over 153 of its Linux servers, and impacting over 3,400 websites the company hosts for its business customers. Nayana\u2019s systems are thought to have been hit by a Linux variant of the Erebus ransomware, designed to","og_url":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/","og_site_name":"ESET Eesti Blogi","article_publisher":"http:\/\/www.facebook.com\/antiviirus","article_published_time":"2017-06-20T14:12:52+00:00","article_modified_time":"2019-05-29T12:06:18+00:00","og_image":[{"width":623,"height":425,"url":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/nayana-623x425-623x425.jpg","type":"image\/jpeg"}],"author":"ESET Blog","twitter_card":"summary_large_image","twitter_misc":{"Written by":"ESET Blog","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#article","isPartOf":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/"},"author":{"name":"ESET Blog","@id":"https:\/\/blog.eset.ee\/et\/en\/#\/schema\/person\/876cf293277fc0b2ae2f4395fffe4c88"},"headline":"Web-hosting firm agrees to pay over $1 million to ransomware extortionists","datePublished":"2017-06-20T14:12:52+00:00","dateModified":"2019-05-29T12:06:18+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/"},"wordCount":482,"image":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/nayana-623x425-623x425.jpg","articleSection":["cybercrime","hacking","privacy","small business"],"inLanguage":"en-US","copyrightYear":"2017","copyrightHolder":{"@id":"https:\/\/blog.eset.ee\/et\/#organization"}},{"@type":"WebPage","@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/","url":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/","name":"Web-hosting firm agrees to pay over $1 million to ransomware extortionists - ESET Eesti Blogi","isPartOf":{"@id":"https:\/\/blog.eset.ee\/et\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#primaryimage"},"image":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/nayana-623x425-623x425.jpg","datePublished":"2017-06-20T14:12:52+00:00","dateModified":"2019-05-29T12:06:18+00:00","author":{"@id":"https:\/\/blog.eset.ee\/et\/en\/#\/schema\/person\/876cf293277fc0b2ae2f4395fffe4c88"},"breadcrumb":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#primaryimage","url":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/nayana-623x425-623x425.jpg","contentUrl":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/nayana-623x425-623x425.jpg","width":623,"height":425},{"@type":"BreadcrumbList","@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.eset.ee\/et\/en\/"},{"@type":"ListItem","position":2,"name":"Web-hosting firm agrees to pay over $1 million to ransomware extortionists"}]},{"@type":"WebSite","@id":"https:\/\/blog.eset.ee\/et\/en\/#website","url":"https:\/\/blog.eset.ee\/et\/en\/","name":"ESET Eesti Blogi","description":"Uudised IT maailmast","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.eset.ee\/et\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.eset.ee\/et\/en\/#\/schema\/person\/876cf293277fc0b2ae2f4395fffe4c88","name":"ESET Blog","sameAs":["http:\/\/eset.ee"],"url":"https:\/\/blog.eset.ee\/et\/en\/author\/allankinsigo\/"},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.eset.ee\/et\/en\/2017\/06\/20\/web-hosting-firm-agrees-to-pay-over-1-million-to-ransomware-extortionists\/#local-main-organization-logo","url":"","contentUrl":"","caption":"ESET EESTI"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/comments?post=421"}],"version-history":[{"count":0,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/421\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media\/1820"}],"wp:attachment":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media?parent=421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/categories?post=421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/tags?post=421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}