USA-based graphics card manufacturer NVIDIA has been exposed to a cyber attack that affected their systems and caused service interruptions. The fact that which carried out the attack simultaneously as the cyber attacks between Russia and Ukraine brought forward the possibility of being related to the Russia-Ukraine crisis. However, a recent statement by Vx-underground, an underground group, claimed that the attack was initiated by a South American-based group of threat actors.
Vx-underground states that LAPSU$ threat actors operating outside of South America claimed responsibility for attacks targeting NVIDIA servers a few days ago. It is claimed that more than 1 TB of NVIDIA proprietary data was compromised due to the attack, and NVIDIA responded to threat actors by trying to encrypt the compromised data through Ransomware software.
Stating that they are continuing their investigations about the attack, NVIDIA has not yet made a statement confirming the claims. It is a concern whether the service and software provided by NVIDIA contain any viruses or malicious code that could infect users. Users should be wary of suspicious activity observed on their systems.
What did NVIDIA say later?
The first reports above came before the company spoke. According to BleepingComputer’s report of 1 March 2022, NVIDIA said it became aware of “a cybersecurity incident which impacted IT resources” on 23 February 2022. The company said it hardened its network, brought in incident response experts and notified law enforcement.
NVIDIA also confirmed that the attacker took employee credentials and some proprietary information, and that this material had begun to leak online. It said it had no evidence of ransomware on its environment, or that the incident was related to the Russia-Ukraine conflict. It did not expect the incident to disrupt its business or its ability to serve customers.
What did the attackers claim?
Per the same report, the group LAPSUS$ claimed it had stolen 1 TB of NVIDIA data. It shared password hashes it said belonged to employees, and it leaked a document archive of nearly 20 GB that it said came from the same data. These are the attacker’s claims, and NVIDIA did not give further detail on what was leaked. Our LAPSUS$ threat group profile sets out what is known about the group.
What should users and customers do?
NVIDIA’s statement, as reported, does not say its software was affected. The original concern still makes sense: treat unexpected driver or tool updates with care. Download NVIDIA software only from the company’s official site. Check that files are signed by the vendor before you run them. Watch for phishing that uses the leak as bait, and keep your systems patched. Our glossary pages on patch management and vulnerability management explain the routine behind that last step.