Taiwanese PC Company MSI Falls Victim to Ransomware Attack

Apr 08, 2023Ravie LakshmananMalware / Cyber Attack

Taiwanese PC company MSI (short for Micro-Star International)
officially confirmed it was the victim of a cyber attack on its
systems.

The company said it “promptly” initiated incident response and
recovery measures after detecting “network anomalies.” It also said
it alerted law enforcement agencies of the matter.

That said, MSI did not disclose any specifics about when the
attack took place and if it entailed the exfiltration of any
proprietary information, including source code.

“Currently, the affected systems have gradually resumed normal
operations, with no significant impact on financial business,” the
company said in a brief notice^[1]
shared on Friday.

In a regulatory filing^[2]
with the Taiwan Stock Exchange, it said that it’s setting up
enhanced controls of its network and infrastructure to ensure the
security of data.

MSI is further urging users to obtain firmware/BIOS updates only
from its official website, and refrain from downloading files from
other sources.

The disclosure comes as a new ransomware gang known as Money
Message added the company to its list of victims. The threat actor
was spotlighted^[3]
by Zscaler late last month.

“The group utilizes a double extortion technique to target its
victims, which involves exfiltrating the victim’s data before
encrypting it,” Cyble noted^[5]
in an analysis published this week. “The group uploads the data on
their leak site if the ransom is unpaid.”

The development comes a month after Acer confirmed^[6]
a breach of its own that resulted in the theft of 160 GB of
confidential data. It was advertised on March 6, 2023, for sale on
the now-defunct BreachForums^[7].