Massachusetts city tells ransomware scumbags to RYUK off, our IT staff will handle this easily
The City of New Bedford, in Massachusetts, has found a way to deal with ransomware without paying: shoring up defenses, restoring from backups, and rebuilding systems.
The attack on the American city’s systems was identified on July 5, after employees noticed unusual network activity upon returning from the July 4th holiday, Mayor Jon Mitchell explained in a press conference on Wednesday.
“We haven’t seen any interruption in municipal services at all,” said Mitchell.
The city’s Management Information Systems (MIS) staff identified the presence of the file-scrambling RYUK nasty, a sophisticated form of ransomware, and through prompt action managed to limit its impact.
Supposedly named for a character in the manga series Death Note, RYUK can find and encrypt network drives, and delete volume snapshots to prevent the use of Windows System Restore in the absence of external backups.
The malware locks up data on target systems and presents a demand for payment in Bitcoin as a condition for receiving a decryption key that, perhaps, will unlock the captured data.
Those behind the infection demanded $5.3m in Bitcoin to release New Bedford’s files, according to Mitchell, who said ransomware outbreaks against government, education and private sector organizations have become more common and more costly – at least in terms of demand, though not necessarily in terms of payment.
In Texas last month, 23 towns were hit by a coordinated ransomware attack. More than half are said to be back to business as usual and Texas officials insist they’re unaware of any ransom being paid.
Unwilling to pay $5.3m, Mitchel said he made a counter-offer of $400,000, based on cyber-insurance proceeds available to the city. The cyber-crim declined and the city continued negotiating, buying the IT staff the time needed to bolster defenses and restore files from backups, to the extent possible.
It doesn’t always go so well. Atlanta, Georgia, Mitchell said, rejected a $50,000 ransom and ended up spending $18m to restore service. For New Bedford, no ransom was paid but Mitchell said he expects further costs in terms of MIS staffing.
Mitchell attributes the relatively minor impact of the infection to luck, skill and the city’s IT architecture.
The luck element has to do with the fact that the malware intrusion began over the July 4th holiday. Holidays and weekends are apparently a common time to launch ransomware attacks because IT staff tends to be scarce and less vigilant then; but in this case the holiday also ensured that many of the city’s desktop PCs were powered down, which limited the ransomware’s ability to spread.
The prompt action of the MIS staff on the morning of July 5th to defensively disconnect systems, according to Mitchell, helped reduce the impact of the infection.
In terms of IT architecture, systems compartmentalization further limited the reach of the software nasty. Police, emergency services, school systems, water and wastewater treatment plants, and trash/recycling services were unaffected. According to Mitchell, only 158 computers, or 4 per cent of the more than 3,500 machines used by city employees were compromised.
Mitchell however made clear that security concerns of this sort will continue. “The reality is that municipalities, corporations and private individuals are in an arms race with cyber criminals who operate in far-flung places around the globe,” he said, noting that over the weekend, Charlton, Mass., had been hit by a cyber assault. “Every advance in antivirus technology is effective until criminals figure out a way around it.” ®
READ MORE HERE