Hackers hijack web hosting service to extort customers

An image of security icons for a network encircling a digital blue earth.
(Image credit: Shutterstock)

A cyberattack on Israeli web hosting provider Cyberserve has disrupted several websites and could have grievous repercussions thanks to the attackers stealing sensitive personally identifiable information (PII) about its clients, some of whom aren’t aligned with the views of the conservative country.

Reporting on the development, BleepingComputer says that the BlackShadow hacking group has claimed credit for the attack.

According to The Times of Israel, in the days leading to the attack, the country’s National Cyber Directorate had warned CyberServe about an imminent cyber attack on several occasions.

TechRadar needs yo...

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> <a href="https://project.tolunastart.com/tqsruntime/main?surveyData=LFFFsT0HpgsyUe0tTFumBJohXK8Sedt0ARpsCF4DRGR+oCoVbvd+2+d8+UNIIx4L" data-link-merchant="project.tolunastart.com"" target="_blank">Click here to start the survey in a new window <<

Surprisingly, in addition to demanding money from CyberServe, BlackShadow is reportedly extorting the hosting provider’s customers as well. 

Attacking clients

BleepingComputer describes BlackShadow as an Iranian state-sponsored hacking group that has a history of attacking Israeli targets, and has been shown to have links with the Pay2Key ransomware strain.

Although the group is said to be demanding $1 million in cryptocurrency from Cyberserve, the threat actors behind BlackShadow are not believed to be financially motivated.

Omri Segev Moyal, co-founder and CEO of Israeli cybersecurity firm Profero, told BleepingComputer that attacks by state-sponsored groups such as BlackShadow are retaliatory and designed to disrupt Israeli interests.

In typical ransomware fashion, BlackShadow immediately leaked a sample of a thousand records to prove that they had exfiltrated client data from the hosting provider.

While leaking PII could always lead to further attacks against the affected individuals, including identity thefts, the situation here could be a lot more damaging. This is because reportedly the leaked data includes PII of a large Israeli LGBT site named Atraf, which in a conservative society could have some serious repercussions on the exposed individuals.

Here's the best cloud hosting services around today

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.