Coca-Cola confirmed it's probing a possible network intrusion after the Stormous cybercrime gang claimed it stole 161GB of data from the beverage giant.

"We are aware of this matter and are investigating to determine the validity of the claim," Coca-Cola communications global vice president Scott Leith told The Register on Tuesday. "We are coordinating with law enforcement."

The ransomware gang, which has declared its support for the Russian government's illegal invasion of Ukraine, this week [1]bragged it "hacked some of the company's servers and passed a large amount of data inside them without their knowledge." It's now trying to sell the stolen data for about $64,000, or nearest offer "depending on the amount of data you want," Stormous wrote on its website where it leaks pilfered information.

[2]

Stormous recently posted a poll on Telegram asking which multinational giant it should target next, and Coca-Cola received 72 percent of the vote, according to a [3]screenshot shared by Security Affairs. And while the crime crew hasn't said it targeted Coca-Cola in retaliation for its support of Ukraine, Stormous' previous statements indicate its support for Putin's war could explain its most recent attack.

[4]

[5]

Coca-Cola previously [6]suspended its business in Russia and said it has committed to [7]contributions totaling $14.8 million to support the Red Cross and other relief efforts in Ukraine.

Stormous, who?

Stormous is a [8]new ransomware gang that acccording to Ivan Righi, an analyst at threat intelligence firm Digital Shadows, publicly emerged in the first quarter of this year. Shortly after Russia invaded Ukraine, however, the cybercriminals were quick to follow fellow ransomware gang Conti's lead and announce its support for Moscow.

"And if any party in different parts of the world decides to organize a cyber-attack or cyber-attacks against Russia, we will be in the right direction and will make all our efforts to abandon the supplication of the West, especially the infrastructure," the crew [9]wrote in Arabic.

[10]Russia's invasion of Ukraine tears open political rift between cybercriminals

[11]Five Eyes nations fear wave of Russian attacks against critical infrastructure

[12]REvil resurrected? Ransomware crew appears to be back. Keyword: Appears

[13]Expect 'long tail of cyber retaliation' from Russia for sanctions, says ExtraHop CEO

More recently, the gang claimed it was under attack by US-based cybersecurity teams, and [14]vowed to "do our best to disrupt the various Western unions," before adding a weirdly ominous ending: "Be on time."

Conti and Stormous aren't the only cybercrime gangs taking sides over the war and targeting either the West or the Kremlin, depending on where their loyalties lie.

Accenture's Cyber Threat Intelligence team, which tracks illicit dark-web activity, recently noted this is the first time it has witnessed "financially motivated threat actors [15]divided along ideological faction."

[16]

"Pro-Russian actors are increasingly aligning with hacktivist-like activity targeting 'enemies of Russia,' especially Western entities due to their claims of Western warmongering," the consultancy said. ®

Get our [17]Tech Resources



[1] https://twitter.com/_bettercyber_/status/1518628584646139904/photo/1

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ymhrj3F@twKUNUEri2VnBQAAAEo&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://securityaffairs.co/wordpress/130614/cyber-crime/stormous-ransomware-hit-coca-cola.html

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ymhrj3F@twKUNUEri2VnBQAAAEo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ymhrj3F@twKUNUEri2VnBQAAAEo&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.coca-colacompany.com/press-releases/coca-cola-company-suspends-business-russia

[7] https://www.coca-colacompany.com/media-center/support-for-ukraine

[8] https://www.digitalshadows.com/blog-and-research/q1-2022-ransomware-roundup/

[9] https://twitter.com/darktracer_int/status/1498644747316981762

[10] https://www.theregister.com/2022/03/15/cyberciminals_russia_ukraine/

[11] https://www.theregister.com/2022/04/21/five_eyes_russia/

[12] https://www.theregister.com/2022/04/22/revil_ransomware_returns/

[13] https://www.theregister.com/2022/03/31/extrahop_russian_sanctions/

[14] https://twitter.com/Cyberknow20/status/1498890450346070018

[15] https://www.theregister.com/2022/03/15/cyberciminals_russia_ukraine/

[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ymhrj3F@twKUNUEri2VnBQAAAEo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[17] https://whitepapers.theregister.com/