Evil Corp Hackers Come Back Online, Was The Garmin Ransom Paid?

Evil Corp hackers came back online after they demanded $10 million to restore full access to Garmin’s customer support service and their navigation solutions as we reported previously in the cryptocurrency news.

The multinational tech company Garmin could have paid some of all of the $10 million crypto ransom to hackers that managed to encrypt the company’s internal network and take down a few of the services on July 23. According to a report from Lawrence Abrams at Bleeping Computer, the IT department of the company used a decryptor to regain the access in their workstations affected by the initial WastedLocker ransomware attack and they were able to use a malware that took down the company’s customer support, navigation solutions and other online services.

The reports also showed the existence of such a protocol means that Garmin likely paid the ransom to the hackers as the malware used in the hack has “no known weaknesses in their encryption algorithm.” Garmin has a timestamp in the script of 07/25/2020 which shows that the ransom was paid between July 24 and July 25. The Russian Evil Corp hackers were responsible for extorting a $10 million crypto ransom from Garmin after the ransomware attack.

The leader of the cybercriminal group Maksim Yakubets previously was indicted by the US Department of Justice in 2019 and he was also listed on the FBI’s most-wanted list with a bounty of $5 million which was the highest amount offered by authorities in the cybercriminal area. The most recent tweet from the company stated that “many of the systems and services affected by the recent outage including Garmin connect will return to operation.” The update from the company’s website stated that Garmin was the “victim of a cyber attack” but made no references to ransomware.

Because the Evil Corp was officially sanctioned by the US government back in 2019, Garmin could even face sanctions for admitting it sent funds to the group. Threat analyst Brett Callow from Emisoft previously said that such a payment could create a “legal minefield.”

 “Payment may be the only way for a company to avoid a catastrophic loss of data. But it may be illegal for the company to make that payment.”

Other companies targeted by ransomware groups ended up paying millions in crypto ransom demands rather than risking to lose their businesses so they allowed computer access to sensitive information. Also, the CWT travel company negotiated with ransomware hackers over a malware attack from $10 million to $4.5 million in BTC.