Netronix homepage was replaced with a message claiming systems were encrypted and about 800 GB taken

According to iThome, on the 31st, CrazyHunter was once again reported targeting Taiwanese enterprises, expanding the scale of its ransomware attacks by simultaneously striking three companies within the Netronix Group (Netronix, Analog Integrations, and Zunidata Systems); when inspecting their websites at 10:00 AM, Analog Integrations and Zunidata Systems were unreachable while the homepage of Netronix had been maliciously defaced ^[1]. According to the defaced content on the Netronix homepage, the attackers simultaneously extorted Netronix, Analog Integrations, and Zunidata Systems, claiming to have encrypted all victim systems, overwritten and deleted NAS, VMware, and Veeam backups, and stolen 800 GB of data spanning file servers, CRM, BPM, EIP, and ERP systems, threatening to leak the first batch of data after 24 hours (at 8:00 PM on April 1) unless contacted ^[1]. Given the 24-hour deadline, the attackers likely lurked in the network for some time before launching the large-scale encryption attack and leaving the ransom note around 8:00 PM on Sunday ^[1].

Industries mainly affected: Manufacturing

Given the 24-hour deadline, the attackers likely lurked in the network for some time before launching the large-scale encryption attack and leaving the ransom note around 8:00 PM on Sunday .