x

Economy

Fallout Continues from Biggest Global Ransomware Attack

BOSTON — The single biggest ransomware attack yet continued to bite Monday as more details emerged on how a Russia-linked gang breached the exploited software company. The criminals essentially used a tool that helps protect against malware to spread it globally.

Thousands of organizations — largely firms that remotely manage the IT infrastructure of others — were infected in at least 17 countries in Friday's assault. Kaseya, whose product was exploited, said Monday that they include several just returning to work.

Because the attack by the notorious REvil gang came just as a long Fourth of July weekend began, many more victims were expected to learn their fate when they return to the office Tuesday. 

REvil is best known for extorting $11 million from the meat processor JBS last month. Security researchers said its ability to evade anti-malware safeguards in this attack and its apparent exploitation of a previous unknown vulnerability on Kaseya servers reflect the growing financial muscle of REvil and a few dozen other top ransomware gangs whose success helps them afford the best digital burglary wares. Such criminals infiltrate networks and paralyze them by scrambling data, extorting their victims.

REvil was seeking $5 million payouts from the so-called managed service providers that were its principal downstream targets in this attack, apparently demanding much less — just $45,000 — from their afflicted customers. 

But late Sunday, it offered on its dark web site to make available a universal decryptor that would unscramble all affected machines if it's paid $70 million in cryptocurrency. Some researchers considered the offer a PR stunt, while others thought it indicates the criminals have more victims than they can manage.

Sweden may be hardest hit — or at least most transparent about the damage. Its defense minister, Peter Hultqvist, bemoaned in a TV interview "how fragile the system is when it comes to IT security." Most of the Swedish grocery chain Coop's 800 stores were closed for a third day, their cash registers crippled. A Swedish pharmacy chain, gas station chain, the state railway and public broadcaster SVT also were hit. 

A wide array of businesses and public agencies were affected, including in financial services and travel, but few large companies were hit, the cybersecurity firm Sophos said. The United Kingdom, South Africa, Canada, Argentina, Mexico, Indonesia, New Zealand and Kenya were among countries affected, researchers said.

In a statement Sunday, deputy U.S. national security adviser Anne Neuberger urged all victims to alert the FBI. A day earlier, the FBI said in an alert  that the attack's scale "may make it so that we are unable to respond to each victim individually." 

The vast majority of ransomware victims are loathe to publicly admit it, and many avoid reporting attacks to law enforcement or disclosing if they pay ransoms unless required by law. 

President Joe Biden  said Saturday that he ordered a "deep dive" by U.S. intelligence into the attack  and that the U.S. would respond if it determines the Kremlin is involved. In Geneva last month, Biden sought to pressure Russian President Vladimir Putin to end safe haven for REvil and other ransomware gangs that operate with impunity in Russia and allied states as long as they avoid domestic targets. The syndicates' extortionary attacks have worsened in the past year.

On Monday, Putin spokesman Dmitry Peskov was asked if Russia was aware of the attack or had looked into it. He said no but suggested it could be discussed during U.S.-Russian consultations on cybersecurity issues. No date has been set for such consultations, and few analysts expect the Kremlin to crack down on a crime wave that benefits Putin's strategic objectives of destabilizing the West. 

Kaseya said Monday that fewer than 70 of its 37,000 customers were affected, though most were managed service providers with multiple downstream customers. Most managed service providers were apt to know by Monday if they were hit but that may not be true for many of the small and medium-sized organizations they serve, said Ross McKerchar, chief information security officer at Sophos. The MSPs are flying blind because the very software tool they use to monitor customer networks was knocked out by the attack.

The hacked Kaseya tool, VSA, remotely maintains customer networks, automating security and other software updates.

In a Monday report on the attack,  Sophos said a VSA server was breached with the apparent use of a "zero day," the industry term for a previously unknown software security hole. Like other cybersecurity firms, it faulted Kaseya for aiding the attackers by asking customers not to monitor its on-premise "working" folders for malware. From inside those folders, REvil's code could work undetected to disable the malware- and ransomware-flagging tools of Microsoft's Defender program.

Sophos said REvil made no attempt to steal data in this attack. Ransomware gangs usually do that before activating ransomware so they can threaten to dump it online unless they are paid. This attack was apparently bare bones, only scrambling data.

In a Sunday interview, Kaseya CEO Fred Voccola would not confirm the use of a zero day or offer details of the breach — except to say that it was not phishing and that he was confident that when an investigation by the cybersecurity firm is complete, it would show that not just Kaseya but third-party software were breached by the attackers.

RELATED

HOUSTON  — A federal judge on Friday ordered the liquidation of conspiracy theorist Alex Jones ′ personal assets but dismissed his company’s separate bankruptcy case, leaving the immediate future of his Infowars media platform uncertain as he owes $1.

Top Stories

Columnists

A pregnant woman was driving in the HOV lane near Dallas.

General News

NEW YORK – Meropi Kyriacou, the new Principal of The Cathedral School in Manhattan, was honored as The National Herald’s Educator of the Year.

Video

1 of 2 Abducted Louisiana Children is Found Dead in Mississippi after Their Mother is Killed

JACKSON, Miss. (AP) — A Louisiana woman was found dead in her home Thursday, and her two young daughters were abducted and found hours later in Mississippi — one dead and the other alive, police said.

ATHENS - Prime Minister Kyriakos Mitsotakis addressing the new Cabinet at a meeting held in the Maximos Mansion on Saturday, said that he chose this first meeting after the elections to coincide with the government reshuffle "in order to send an overall message of dynamic restart because June 9 was a landmark in our up to date course but also a new start for the next three years of our term" .

NEW YORK – The Capital Link Invest in Greece Webinar Series 2024 continues Tuesday, June 18, 10 AM EST / 3 PM London / 4 PM CET / 5 PM Athens, with the brief presentation and roundtable discussion titled: ‘Greek Economy: Prospects & Outlook Post Investment Upgrade.

DALLAS  — Luka Doncic scored 25 of his 29 points in the first half, Kyrie Irving added 21 points and the Dallas Mavericks emphatically extended their season on Friday night, fending off elimination by beating the Boston Celtics 122-84 in Game 4 of the NBA Finals.

WASHINGTON  — The Supreme Court on Friday struck down a Trump-era ban on bump stocks, the rapid-fire gun accessories used in the deadliest mass shooting in modern U.

Enter your email address to subscribe

Provide your email address to subscribe. For e.g. [email protected]

You may unsubscribe at any time using the link in our newsletter.