European IT services provider Sopra Steria on Monday said its systems were recently infected with a new variant of the notorious Ryuk ransomware.
France-based Sopra Steria, which claims to have 46,000 employees across 25 countries, offers a wide range of IT services, including consulting, technology, software, system integration, business process, infrastructure management and cybersecurity.
The company reported on October 21 that it had detected an intrusion on its IT network the day before and that it had started working on containing the incident.
In an update shared on Monday, the IT giant said it was targeted in a cyberattack that involved a new variant of the Ryuk ransomware, a variant that allegedly was “previously unknown to antivirus software providers and security agencies.”
“Sopra Steria’s investigation teams immediately provided the competent authorities with all information required. The Group was able to quickly make this new version’s virus signature available to all antivirus software providers, in order for them to update their antivirus software,” the company said. “Moreover, it has also been established that the cyberattack was only launched a few days before it was detected.”
The fact that the attackers only gained access to Sopra Steria systems just days before the attack was uncovered is not surprising. The DFIR Report said recently that in one of the attacks it observed, only 29 hours passed between the first email being sent by the hackers and systems becoming fully compromised and encrypted.
Sopra Steria said the incident only impacted a “limited part” of its infrastructure and claimed that it had found no evidence of data leaks or damage to customer systems. However. the firm expects that it will take a few weeks until all operations return to normal.
Russia-linked cybercriminals who use the Ryuk ransomware have been known to also steal data from victims in an effort to increase their chances of getting paid.
The Ryuk ransomware has often been delivered via the TrickBot botnet, whose infrastructure was recently targeted for takedown by both the U.S. government and private sector companies. While the operation against TrickBot appears to have been successful — at least to some degree — it was reported just days before Sopra Steria was targeted that Ryuk attacks continued.
Related: Pitney Bowes Says Disruptions Caused by Ryuk Ransomware
Related: Human-Operated Ransomware Is a Growing Threat to Businesses: Microsoft
Related: Durham City, County Recovering After Ransomware Attack

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
- UK Gov Warns of Phishing Attacks Launched by Iranian, Russian Cyberspies
- Dozens of Cybersecurity Companies Announced Layoffs in Past Year
- Security Update for Chrome 109 Patches 6 Vulnerabilities
- New Open Source OT Security Tool Helps Address Impact of Upcoming Microsoft Patch
- Forward Networks Raises $50 Million in Series D Funding
Latest News
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Cyberattacks Target Websites of German Airports, Admin
- US Infiltrates Big Ransomware Gang: ‘We Hacked the Hackers’
