Telecom Argentina has been handed a ransom demand of £5.81 million by ransomware hackers who have managed to encrypt up to 18,000 computers using stolen admin credentials.

The ransomware attack targeting IT systems belonging to Telecom Argentina took place on 18th July and involved hackers pasting a ransom note on the telecom giant’s systems, giving the company just three days to pay the ransom to recover its files or risk having the ransom amount doubled.

According to ZDNet, hackers used internal IT admin credentials to gain access to Telecom Argentina’s computers and were successful in installing their ransomware payload into up to 18,000 workstations. The telecom company has advised employees not to connect to its internal VPN network, not open emails containing archive files, and to limit their interaction with the corporate network.

Telecom Argentina is yet to issue a statement concerning the ransomware attack and it is not clear if a ransom has been paid even though the three-day period given by hackers has expired. No hacker group has taken responsibility for the ransomware attack so far.

Despite impacting thousands of computers connected to the telecom company’s internal server, reports from Argentina have claimed that the ransomware attack has not impacted internet connectivity or any service being provided to millions of Argentinians.

Several reports have also claimed that the hackers found their way in after targeting Telecom Argentina’s employees with phishing emails and obtaining their login credentials. Commenting on this, Tarik Saleh, senior security engineer at DomainTools, said that the majority of spam emails, and clearly the one on which a Telecom employee, unfortunately, click on, have the goal of getting the victim to infect their own computer with malware.

“Soft targeted” email is often the vessel for malicious attachments—for instance, an email may be sent to an HR employee with a .pdf of a job seeker’s resume. In actuality, the resume is an attachment that contains embedded ransomware or malware. In these instances, the infection that this phish brought can now spread from PC to other networked devices—including the cloud,” he added.

Commenting on the successful ransomware attack, Mark Bagley, VP of Product, AttackIQ, said that this is likely to be one of the more expensive ransomware attacks this year and a security programme that included network segmentation, preventing the lateral movement of an adversary would have been decisive in mitigating this situation.

“Legacy approaches that focus on stopping an adversary at their initial attempts to access targets of interest will continue to fail. Companies must design their security programmes to minimise the impact when an adversary successfully infiltrates their network.

“This control of lateral movement is imperative to preventing many other adversary behaviours. Preventing an adversary from using credentials harvested from one system elsewhere in the network – a technique called “credential stuffing” when automated – is one crucial way organisations can reduce the damage of an attack.

“Given the increases in sophistication and automation that have been observed in recent attacks, it’s not enough to address cyber threats as they happen. A proactive cyber security approach is vital and should include continuous testing of security posture to identify exposures and improve defenses before adversaries apply exploits to them,” he added.