sb-eu logo
Story image

Ransomware vs cities in 2019: 174 and counting

16 Dec 2019

2019 has been the “year of ransomware attacks on municipalities”, according to Kaspersky security experts.

This comes after the company’s researchers observed that at least 174 municipal institutions, with more than 3,000 subset organisations, have been targeted by ransomware during the last year.

This represents a 60% increase at least, from the figure in 2018.

While threat actors’ demands would sometimes reach up to $5,000,000, actual costs and damages sustained during attacks are estimated to be larger.

These are among the main findings of Kaspersky’s Security Bulletin: Story of the Year 2019.

Ransomware is a notorious headache for the corporate sector, affecting businesses around the world for a number of years.

As if that wasn’t enough, 2019 has seen the rapid development of an earlier trend, where malware distributors have targeted municipal organisations.

Researchers note that while these targets might be less capable of paying a large ransom, they are more likely to agree to cybercriminals’ demands.

Blocking any municipal services directly affects the welfare of citizens and results, not only in financial losses but other socially significant and sensitive consequences.

Judging by publicly available information, the ransom amounts varied greatly, reaching up to $5,300,000 and $1,032,460 on average.

The researchers noted that these figures do not accurately represent the final costs of an attack, as the long-term consequences are far more devastating.

Kaspersky security researcher Fedor Sinitsyn says, “One must always keep in mind that paying extortionists is a short-term solution which only encourages criminals and keeps them funded to quite possibly return.

“In addition, once the city has been attacked, the whole infrastructure is compromised and requires an incident investigation and a thorough audit. This inevitably results in costs that are additional to ransom.

“At the same time, based on our observations cities might be sometimes inclined to pay because they usually cover the cyber risks with help of insurance and allocating budgets for incident response. However, the better approach would be also investing in proactive measures like proven security and backup solutions as well as a regular security audit.”

“While the trend of attacks on municipalities is only growing, it can be stifled and nipped in the bud by adjusting the approach to cybersecurity and what is more important by the refusal to pay ransoms and broadcasting this decision as an official statement.”

The malware that was most often cited as a culprit varies too, yet three families were named as the most notorious, by Kaspersky researchers: Ryuk, Purga and Stop.

Ryuk appeared on the threat landscape more than a year ago and has since been active all over the world, both in public and in the private sector.

Its distribution model usually involves delivery via backdoor malware which in turn spreads by the means of phishing with a malicious attachment disguised as a financial document.

Purga malware has been known since 2016, yet only recently municipalities have been discovered to fall victims to this trojan, having various attack vectors – from phishing to brute force attacks.

Stop cryptor is a relative novice as it is only one year old.

It propagates by hiding inside software installers.

This malware has been popular, number seven in the top 10 most popular cryptors ranking of Q3 2019.

To avoid such malware infiltrating organisations, Kaserspky has the following recommendations:

  • It is essential to install all security updates as soon as they appear.
  • Most cyberattacks are possible by exploiting vulnerabilities that have already been reported and addressed, so installing the latest security updates lowers the chances of an attack
  • Protect remote access to corporate networks by VPN and use secure passwords for domain accounts.
  • Always update your operating system to eliminate recent vulnerabilities and use a robust security solution with updated databases
  • Always have fresh back-up copies of your files so you can replace them in case they are lost (e.g. due to malware or a broken device) and store them not only on the physical object but also in cloud storage for greater reliability
  • Remember that ransomware is a criminal offence.
  • You shouldn’t pay a ransom.
  • If you become a victim, report it to your local law enforcement agency. Try to find a decryptor on the internet first – some of them are available for free.
  • Educating the staff in cybersecurity hygiene is necessary to prevent attacks from happening.
  • Use a security solution for organisation to protect business data from ransomware.
  • The product has behaviour detection, anomaly control and exploit prevention capabilities that detect known and unknown threats and prevent malicious activity.
Story image
GCloud updates capabilities with Anthos enhancements
Google Cloud has announced improvements for hybrid compatibility, services, development, migration and identity security with updates to Anthos.More
Story image
Ripple20 threat has potential for 'vast exploitation', ExtraHop researchers find
One in three IT environments are vulnerable to a cyber threat known as Ripple20. This is according to a new report from ExtraHop, a cloud-native network detection and response solutions provider. More
Story image
BT Security shakes up roster of vendors after 'largest ever' partner review
BT says the decision to review their security partner base was driven by the recognition that many customers find it difficult to navigate today’s complex security landscape, as well as customers’ desire to have a ‘leaner set of partners’.More
Story image
Lazarus Group linked to phishing attacks on cryptocurrency sector
In this case, the attacks were launched through a phishing document sent via LinkedIn to employees at the targeted organisation. This phishing document was styled to look like a job advertisement for a role in a blockchain company.More
Story image
Ripple20 threat could affect 35% of all IT environments – ExtraHop
The vulnerabilities have the potential to ‘ripple’ through complex software supply chains, enabling attackers to steal data or execute code.More
Story image
Phishing scam imitates SharePoint & OneNote for nefarious clicks
Sophos researchers say that the attackers take a slightly different approach to the standard ‘fake login’ phishing email.More