Search This Blog

Showing posts with label Fujitsu. Show all posts

Data From Fujitsu is Being Sold on the Dark Web

 

An organisation called Marketo is selling data from Fujitsu on the dark web, although the firm claims the information "appears to be tied to customers" rather than their own systems. Marketo announced on its leak site on August 26 that it had 4 GB of stolen data and was selling it. They claimed to have private customer information, company data, budget data, reports, and other company papers, including project information, and gave samples of the data.

Fujitsu Limited, based in Tokyo, is a Japanese multinational information and communications technology equipment and services firm founded in 1935. After IBM, Accenture, and AWS, Fujitsu was the world's fourth-largest IT services company by yearly sales in 2018. Fujitsu's hardware portfolio consists mostly of personal and enterprise computing solutions, such as x86, SPARC, and mainframe compatible servers. 

Initially, the group's leak site stated that there were 280 bids on the data, but now it only shows 70 offers. A Fujitsu representative downplayed the event, saying there was no evidence it was linked to a case in May in which hackers used Fujitsu's ProjectWEB platform to steal data from Japanese government agencies. 

"We are aware that information has been uploaded to dark web auction site 'Marketo' that purports to have been obtained from our site. Details of the source of this information, including whether it comes from our systems or environment, are unknown," a Fujitsu spokesperson said. 

Marketo is a reliable source, according to Ivan Righi, a cyber threat intelligence expert at Digital Shadows. The veracity of the material stolen, according to Righi, cannot be validated, but prior data leaks by the group have been found to be real. 

"Therefore, it is likely that the data exposed on their website is legitimate. At the time of writing, Marketo has only exposed a 24.5 MB 'evidence package,' which contained some data relating to another Japanese company called Toray Industries. The group also provided three screenshots of spreadsheets allegedly stolen in the attack," Righi said.

The group has gone as far as sending samples of stolen data to a company's competitors, clients, and partners in the past to embarrass victims into paying for their data back. The group has listed hundreds of firms on their leak site, most notably Puma, and releases one every week, usually selling data from US and European corporations. At least seven industrial goods and services firms, as well as healthcare and technology firms, have been targeted. 

According to Brett Callow, a ransomware expert, and threat analyst at Emsisoft, it's unknown how Marketo gets the data it offers, but there's evidence that the data is frequently linked to ransomware attacks.

Fujitsu ProjectWEB Tool Used as a Doorway to Target Japanese Government Offices

 

Cybercriminals have breached the offices of multiple Japanese agencies by hacking into Fujitsu’s software-as-a-service (SaaS) platform and gaining access to its systems. 

A number o confidential files belonging to multiple Japanese government entities were also stolen after attackers gained unauthorized access to projects that used ProjectWEB, Fujitsu stated.

Various agencies including the Ministry of Land, Infrastructure, Transport, and Tourism; the Ministry of Foreign Affairs; the Cabinet Secretariat; and the Narita Airport acknowledged that hackers were able to gain inside information via Fujitsu's information-sharing tool. 

ProjectWEB is a software-as-a-service (SaaS) platform for enterprise collaboration and file platform that Fujitsu has operated since the mid-2000s, and which a number of agencies within the Japanese government currently use. Fujitsu's ProjectWEB enables companies and organizations to exchange information internally, with project managers and stakeholders, for example.

Japanese press reported Narita International Airport, located near Tokyo, was impacted as well since Fujitsu attackers managed to steal air traffic control data, flight schedules, and information on business operations. Japanese press reported that the attackers stole documents that contained more than 76,000 email addresses for employees and contractors for the Ministry of Land, Infrastructure, Transport, and Tourism. However, the local authorities did not confirm the reports in a press conference on Wednesday. 

As a precautionary measure, Cabinet Secretariat's national cybersecurity center (NISC) issued multiple advisories alerting government agencies and critical infrastructure organizations using Fujitsu's tool to check for signs of unauthorized access and information leakage.
 
Fujitsu suspends ProjectWEB online portal 

Fujitsu decided to shut down the ProjectWEB platform on Tuesday to investigate the ‘scope and cause’ of the breach following the pressure from NISC and apologized “for the great concern and inconvenience” the breach caused its customers. 

“We will continue to work on investigating and analyzing the scope of impact and the causes of all projects that use [ProjectWEB] with the cooperation of our customers. We take this case very seriously and will continue to consult with the relevant authorities and make every effort to support the victims. that’s all Inquiries regarding this matter.” reads the data breach notice published by the Japanese firm. 

This is the second cyber incident the government of Japan has suffered in a month. In late April, a malicious campaign exploited two flaws, tracked as CVE-2020-5639 and CVE-2021-20655, in the popular file-sharing server FileZen to steal sensitive data from businesses and government organizations as part of a global hacking campaign that affected the Japan Prime Minister’s Cabinet Office.