Clop ransomware gang clips sensitive files from Atlantic Records’ London ad agency The7stars, dumps them online

January 22, 2021 TH Author

Updated A London ad agency that counts Atlantic Records, Suzuki, and Penguin Random House among its clients has had its files dumped online by a ransomware gang, The Register can reveal.

The7stars, based in London’s West End, filed [PDF] revenues of £379.36m up from £326m, gross billing of £426m and net profit of £2.1m for the year ended 31 March 2020.

In the same accounts filed with UK register Companies House, it boasted of its position as the “largest independently owned media agency in the UK by a significant factor”, making it a juicy target for the Clop ransomware extortionists.

The attack appears to have happened after 15 December, when The7stars’ annual return was prepared for filing with Companies House. While the document talks in length about its healthy financial performance, it mentions nothing about cyber risks or attacks.

Screenshots published on the Clop gang’s Tor website show scans of passports, invoices, what appears to be a photo from a staff party and, ironically, a “data protection agreement.”

Publication of stolen files on a ransomware crew’s website is typically an indicator that a ransom demand has been rebuffed, though more aggressive tactics seen in the last year include pre-emptive leaking of stolen data as an apparent incentive for marks to pay up quickly.

The agency’s client list includes Led Zeppelin’s former label Atlantic Records, Japanese motorbike maker Suzuki, and British train operating companies including Great Western Railway, among others. It is very unlikely that those companies will have been directly affected, though it appears Clop wants to give the impression that it has stolen commercially sensitive documents relating to The7stars’ clients.

An ICO spokesperson sent us a statement: “We received a report from the7stars about a ransomware attack and we are making enquiries to assess the information provided.”

We have asked The7stars for comment.

As we reported last year when the same extortionist gang targeted Germany’s Software AG, the Clop criminals are noticeably pushier than others running the same steal ‘n’ extort scam.

Brett Callow, threat analyst at infosec biz Emsisoft, told us at the time: “Clop is a variant of CryptoMix and may be used by the group behind the Dridex banking trojan. Like REvil and NetWalker, it is primarily used to target enterprise networks, with known past victims including Prominent and ExecuPharm.” He added that Clop’s ransom demands can run into the millions.

The fight against ransomware is essentially one of making the business model uneconomic. To that end, not buying off the crooks (and making sure your insurance company doesn’t pay up on your behalf) is the first step to take – and the Scottish Environment Protection Agency’s example is one that industry should be following. ®

Updated to add

“We can confirm that we recently experienced an IT incident, in the form of a sophisticated ransomware attack,” a spokesperson for the7star told The Register.

“We were able to restore our systems from back-ups and are continuing to investigate as an absolute priority. Subsequently, those responsible for this criminal activity released information extracted from our systems online. We are liaising closely with our clients to offer our ongoing support and have informed the police.”