Since CloudNordic couldn't find the security vulnerability that led to the ransomware attack, what would you strongly guess be the reason behind this attack? I'd like to question this because consequently, most readers mention that using AWS, GCP, or Azure would be superior compared to small companies.
CloudNordic only had a few weak factors like no scheduled offsite backup or redundancy (although can claim that the offsite backup is client's responsibility). I didn't see any big client knocking on their doors with negligibility lawsuits.
If these insecurities keep growing, smaller companies will have less chances to convince their customer to rely on themselves, leading to oligopoly.
Although I'm not a CyberSecurity expert, based on their statement or as stated on techCrunch article,
It’s not clear how the ransomware attack began, but the company said that the attack happened — or was at least exacerbated — by moving infected systems from one data center to another data center that was “unfortunately wired to access our internal network that is used to manage all of our servers.” CloudNordic said that it “had no knowledge that there was an infection.”
“Via the internal network, the attackers gained access to central administration systems and the backup systems.”
I'd like to assume that they were using private IP to transfer data between the data centers. This is unlikely to expose any holes until either the IP is exposed and there's no Firewall/IP Blacklist, or unless there's already a ransomware installed in the system via infected OS packages or libraries.
The latter would be unlikely to happen since this was triggered only during or after data transfer or migration. Or there could be a scenario that one of their customers or employees were trying to attempt and finally succeeded because the new data center was vulnerable.
Another scenario, if they migrated all the resources from one data center to another data center, there could've been a heated exchange or payment dues with the former data center.
CloudNordic would have migrated using remote SFTP, whose IP has been logged onto the outgoing traffic. The malicious attacker found out and either brute-forced the password attempts (or) the admin in charge of migration forgot to remove the key file.
What do you think would have triggered this because I don't think there'd be any external trigger but rather a personal grudge.