KISCO: ransomware, starting from a firewall used for overseas remote access

On 26 August 2024 KISCO, an Osaka chemicals trading company, disclosed a ransomware attack. From around 2:00 on 24 August several servers in its data centre stopped one after another, and as the damage reached its Tokyo head office it disconnected systems and PCs from the network. Files demanding money were left behind; the company did not pay. According to its report of 3 October, the attack started with a compromised firewall that gave remote access to staff at overseas sites; after its access policy was changed, the attackers entered the internal network, stole administrator IDs and passwords and accessed several business systems. Outside experts have told the company the incident is over.