Jump to content

Colossal Ransomware Attack


Poolflood

Recommended Posts

39 minutes ago, Harrison Bergeron said:

I may be wrong, but it seem like since January our military has been laser focused on defending the homeland from cyber or military attacks. I mean after four years of distraction, it seems like they have really doubled-down and focused on possible threats and refused to be distracted by silly bullshit.

Or they could be attacking hospitals right now. As far as I understand. 

Link to comment
Share on other sites

2 hours ago, Nicole44 said:

I’d be curious to know how many of the software companies and the companies they sell to/protect they “protect” are out of Eastern Europe. Same flaws same window to hack. Thoughts?

These guys design their malware to avoid attacking Russian systems. Literally they have checks in place to avoid installing malware on a Russian system.

 

 

Link to comment
Share on other sites

4 hours ago, Harrison Bergeron said:

I may be wrong, but it seem like since January our military has been laser focused on defending the homeland from cyber or military attacks. I mean after four years of distraction, it seems like they have really doubled-down and focused on possible threats and refused to be distracted by silly bullshit.

You are...

Link to comment
Share on other sites

4 hours ago, Nicole44 said:

So why hack hospitals? 

For the most part, these aren't targeted attacks. Most ransomware is just blasted out at random through fishy emails and dropped USB sticks and dodgy websites, and typically is brought into the network through a user that has been duped. 

It just so happens that most people at a hospital aren't super technically savvy and have more pressing matters to concern themselves with, not to mention the propensity of profit-driven orgs to cut IT and security budgets because of their traditional positioning as a cost center

  • Hook 'Em 1
Link to comment
Share on other sites

On 7/3/2021 at 8:22 PM, AUS-97HORN said:

to be fair, most IT departments have become much, much better at sending non-obvious phishing traps.       Its not " Clikc here Mr empoylee, free vacaton" anymore. 

 

in the last year I have emails that purport to be from the HR team asking for company feedback... but the clue was  to preview the link provided, which was taking you to a 3rd party page that didnt seem right. (and the email was from a "one letter difference" domain)   Or emails from THE CEO that name the company CEO telling everyone to check on their upcoming raises..... that one got like half the fucking company.      never underestimate the complete lack of intelligence re: security when good old fashioned greed gets involved.  IT had to explain to everyone that the CEO name is easily found and any phisher worth a damn would be able to try that. 

Important to note that we are tested on exact copies of phish emails have actually WORKED for real in the real world (at other companies) which is how they got the template.

 

Our team gets graded on how many times we mark the emails as phish spam.... every so often someone gets got.... but, other than the money one, we do very well..... except.... we've got a 69/70 year old lady whos worked for the company for 20+ years on our team....  She is so kind, and helps out anytime you ask her and shes always mentoring new hires.  But,she has basically been caught every single time.   Shes gone through at least 5 trainings lasting more than 2 hours showing her what to look for, but she gets so behind every morning, that by the end of the day shes opening emails without even bothering to see who the fuck they are from and double clicking every attachment or link.   

I dont even think firing her is on the table... but its amazing how she gets tricked on every fucking test, every month. 

Rules.

  • Hook 'Em 2
  • Like 1
  • Haha 1
  • Drool 1
Link to comment
Share on other sites

7 hours ago, Nicole44 said:

So why hack hospitals? 

Because hospitals are low hanging fruit that put almost no effort into protecting themselves. They are the Kliff Kingsbury of defense. Seriously, it's criminal how bad hospitals are at securing their environments. 

 

  • Hook 'Em 1
Link to comment
Share on other sites

Thinking about how weak most hospital's security postures are compared to other business organizations the default thought is well they are critical infrastructure and they are all pretty bad. However now that I think about it the healthcare sector is one of the worst if not worst sector in critical infrastructure.

Most critical infrastructure sectors, particularly the energy, water and transportation understand the concept of reliability so they understand "we have to keep things running" which translates well to the Availability part of the CIA Triad in security. It's a starting place to work from with these sectors. Hospitals do not have this mantra. It's always "we are dealing with people's lives" and everything else takes a back seat. The healthcare industry has HITRUST CSF but it's usually implemented as a "best practice only" guide meaning they should implement certain controls but they don't have to.

At least power utilities must implement NERC controls but hospitals don't really have any regulations that require them to enforce security controls.

 

 

 

Link to comment
Share on other sites

Clever. Don't target Russian companies so Putin won't care.

https://www.nbcnews.com/politics/national-security/code-huge-ransomware-attack-written-avoid-computers-use-russian-says-n1273222

Quote

WASHINGTON — The computer code behind the massive ransomware attack by the Russian-speaking hacking ring REvil was written so that the malware avoids systems that primarily use Russian or related languages, according to a new report by a cybersecurity firm.

It's long been known that some malicious software includes this feature, but the report by Trustwave SpiderLabs, obtained exclusively by NBC News, appears to be the first to publicly identify it as an element of the latest attack, which is believed to be the largest ransomware campaign ever.


"They don't want to annoy the local authorities, and they know they will be able to run their business much longer if they do it this way," said Ziv Mador, Trustwave SpiderLabs' vice president of security research.

 

Link to comment
Share on other sites

21 minutes ago, crash_davis said:

 

These groups should probably be seen as pirates that occasionally act as privateers. Rob ships with French sails but not British and the Royal navy will leave you alone. When necessary attack French or Spanish ships on behalf of the British crown and keep the spoils after making a small tribute.

 

  • Hook 'Em 2
Link to comment
Share on other sites

26 minutes ago, F250 said:

 

These groups should probably be seen as pirates that occasionally act as privateers. Rob ships with French sails but not British and the Royal navy will leave you alone. When necessary attack French or Spanish ships on behalf of the British crown and keep the spoils after making a small tribute.

 

That's actually a very good analogy. Raping and pillaging from a computer 1000s of miles away while watching porn. Pirates never had it so easy.

Link to comment
Share on other sites

3 hours ago, crash_davis said:

So how much extra work to cut and paste "War and Peace" in the original language into a remarks line?

Link to comment
Share on other sites

Scenario 2 leading to 1 seems very likely.
 
 

This is the usual for them to take a break. They always go quiet after a while. Either sell the platform and make a new one or revamp it.

Hopefully they did get caught though. But I doubt it
  • Hook 'Em 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...