NAME : M.

ZOHAIB
ROLL NO : SP22-BSE-042
INSTRUCTOR : HUFSA MOHSIN
ASSIGNMENT : 2
ASSIGNMENT:2
Q) Discuss a case study of any famous cyber security scam.

ANSWER
Introduction:
On April 17, 2020, a leading it organization COGNIZANT was severely attack by MAZE
RANSOMWARE.

Objective:
The objective of this attack was to lock and incrypt the data of company. The attacker in this case
has the ability to exfiltrate or transfer the data onto his or her server. The data is then held on this
server until a ransom is paid to recover it. If the victim does not pay the ransom, the attackers
then publish the data online.

Domain:
Cognizant is an IT company. So the domain of this attack is IT.

Technology:
The technology used in this attack was ransomware. Ransomware is a type of malicious
program used by hackers to take control of files in an infected system and then demand hefty
payments to recover them. The maze ransomware itself is a 32 bit binary file usually in the guise
of a .exe or .dll file. Once maze is deployed on an end users machine it does following it encrptys
users file and send ransomware payment demand. The company has not given detail how their
assets got compromised..

Resolution:
 The company has been engaging with the appropriate law enforcement authority and getting
help from cyber defense companies. They update software and operating systems. And they
backing up the data.

Potential Losses:
Hackers demands 25-30 million Dollars for the recovery of data. If they do not pay the
ransomware, they publicly publish the data. And put it on the open forums. Company also bear
the lose of 50-60 million Dollar in the value of their shares.

Lesson learnt:
Cognizant is applying learnings from the attack to further harden its network. After this attack
the other big IT companies also improve their security level. They reduce internal
communication using cloud technologies. Refer to security specialists for assistance and
guidance. Repeat as necessary. Unfortunately, you will never be 100% secure, so security
services audits, implementation, and monitoring should be an ongoing, dynamic exercise.