Ransomware attacks are nearly daily news in 2021 and there’s a reason why: It’s a lucrative business for cybercriminals who know that even if some of their targets won’t pay up, others will.

Enter a ransomware attack on insurance company CNA Finance Corp. in March. At the time, the company only said that it was targeted by a “sophisticated cybersecurity attack.” Although it didn’t disclose that the attack was ransomware, it was suggested that it had been a victim.

Now it seems that CNA paid a whopping $40 million ransom in response to the “cyberattack,” which was always a ransomware attack. Bloomberg reported that CNA paid the ransom about two weeks after the attack that included a trove of their data being stolen as well.

CNA said in a statement that the company followed the law and that it had consulted and shared intelligence about the attack with the U.S. Federal Bureau of Investigation and the Treasury Department’s Office of Foreign Assets Control. The Treasury Department said in October that paying ransomware demands may be illegal and that companies that do so could be prosecuted.

“CNA is not commenting on the ransom,” a spokesperson for CNA told Bloomberg. “CNA followed all laws, regulations and published guidance, including OFAC’s 2020 ransomware guidance, in its handling of this matter.”

In a security incident update published May 12, CNA said that it had been working diligently with outside experts to determine what happened during the course of the attack. The company noted that “as a result of our efforts, we are confident that the threat actor has not accessed the CNA environment since the ransomware event.”

At the time of the initial ransomware attack on CNA, it was reported that it might have involved the REvil ransomware gang. Bloomberg, however, said it involved malware called Phoenix Locker, sometimes also called “Hades,” that is linked to the hacking group Evil Corp.

Bleeping Computer reported in March that Evil Corp had switched to using Hades as a way to evade sanctions imposed by the Treasury Department’s Office of Foreign Assets Control. Given that CNA has allegedly paid up, the text is fitting.

“The U.S. Treasury Department sanctioned Evil Corp gang members in December 2019 after being charged for using Dridex to cause over $100 million in financial damages,” Bleeping Computer wrote. “Because of this, their victims face a tricky situation if they want to pay Evil Corp’s ransom as they would also violate the sanctions.”

How Hades bypasses sanctions is not clear.

Photo: RHok Chicago/Flickr