Ransomware moves to the big time
Connecting state and local government leaders
Criminals are getting better at what they do and upping the ante by attacking larger agencies and demanding more money.
As ransomware exploits and their perpetrators become more sophisticated, ransomware is climbing up the ladder – moving beyond targeting local agencies for a few hundred dollars and into the federal ranks and beyond.
When it comes to ransom, there has typically been a dividing line between large federal agencies and smaller local ones, just as there is between Fortune 500 companies and small businesses, according to Mark Weatherford, senior vice president for vArmour and former deputy undersecretary for cybersecurity at the Department of Homeland Security. Online criminals often target smaller organizations first, because they lack the resources or the experience to fight back. “It’s the result of poor user awareness and social engineering, that’s what makes this easy pickings,” Weatherford said. “If the [agency] needs to pay a few hundred dollars, they can often take that out of petty cash.”
But ransomware criminals are getting better at what they do and upping the ante by attacking larger organizations and demanding more money. In February 2016, Los Angeles-based Hollywood Presbyterian Medical Center reported that it had paid $17,000 in bitcoins to hackers who had ransomed the hospital’s computer systems. Like a hospital, a government agency depends on its information and its systems to operate, said Kristine Trierweiler, assistant town administrator for the Town of Medfield, Mass. The hackers are banking on “the importance of our data and the need to have our data at any cost,” she added.
By April 2016, ransomware attacks on the House of Representatives had reportedly increased so much that the use of third-party email providers including Yahoo Mail and Gmail were blocked over concerns about ransomware’s spread. The previous month, Sen. Tom Carper (D-Del.) of the Senate Committee on Homeland Security and Governmental Affairs received letters from both the Department of Justice and the Department of Homeland Security responding to questions about how the agencies are combatting the attacks.
In the letter from DOJ, Assistant Attorney General Peter J. Kadzik pointed out that while ransom fees “are typically between $200 and $10,000, victims include additional costs they incurred due to the ransomware incidents,” including network migration, network countermeasures, loss of productivity, legal fees, IT services and purchasing credit monitoring services for employees or customers.
“As actors become more sophisticated, it has become paramount for the FBI and DOJ to coordinate and collaborate closely with the private sector and foreign law enforcement partners to understand how the variant works, what vulnerabilities exist, what legal options can be utilized, and where the actor's infrastructure is located,” Kadzik wrote in the letter. “This collaboration is also used to prioritize law enforcement efforts and target the highest priority botnets and malware variants.”
DHS told Carper that it collaborates with the FBI through its National Cybersecurity and Communications Integration Center (NCCIC) to produce and disseminate information about cyberthreats through public alerts, Joint Indicator Bulletins (which are distributed on a more timely basis to “cybersecurity stakeholders with a need-to-know”) and Joint Analysis Reports, which offer a more specific technical analysis of tactics and procedures for detecting and combating threats.
DHS’s letter pointed out that “law enforcement entities like the U.S. Secret Service and FBI share threat indicator information with NCCIC for technical analysis.” In cooperation with other federal government agencies and law enforcement, the NCCIC utilizes Einstein 3 Accelerated intrusion detection and prevention system administered by DHS. E3A conducts email filtering, which protects against malicious file attachments and embedded links in email content, and Domain Name System “sinkholing,” which prevents malware already on government computers from contacting command and control servers.
NEXT STORY: Tied up and held for ransom