Lee Enterprises said it is investigating a claim from the Qilin ransomware group that it was behind a massive breach of the newspaper chain’s network in early February.
The threat group claims to have stolen 350 GB of data during an early February attack, according to researchers at SentinelOne. The group threatened to begin leaking data on March 5, but the specific ransom demand is not immediately known.
“We are aware of the claims and are currently investigating them,” a spokesperson for Lee Enterprises said via email.
Lee Enterprises previously confirmed in a regulatory filing that hackers encrypted critical applications and stole data in a Feb. 3 attack. The company warned the attack would likely have a material impact on its financial results and operations.
The attack disrupted print distribution, billing, payments and other aspects of the publishing company. The firm operates in 72 markets across 25 U.S. states, and is the publisher of major regional newspapers such as the Omaha World-Herald, the St. Louis Post Dispatch and the Buffalo News.
The company was forced to manually process transactions following the attack.
Qilin, a ransomware as a service operation, emerged as a rebrand of the Agenda ransomware operation in 2022, according to Jim Walter, a threat researcher at SentinelOne. The group has about 60 alleged victims on its leak site.
The group’s preferred method of attack is to abuse stolen or compromised credentials or gain entry through spearphishing.
Qilin has payloads for Linux and Windows systems and frequently targets virtual/ESXi environments as well, according to Walter.
The Lee Enterprises attack bears all the hallmarks of Qilin’s double extortion strategy, according to researchers at Darktrace. First, threat actors steal sensitive data and then encrypt what remains, thus creating multiple pressure points for payment.
“What makes Qilin stand out isn't necessarily technical sophistication, but their patient, methodical approach,” Toby Lewis, head of threat analysis at Darktrace, said via email. “They conduct extensive reconnaissance, disguise their communications with encryption certificates to appear legitimate, and carefully choose exactly what to steal before launching the final attack.”
