Phishing in a Port
Among the ransomware that caused so much disruption in the latter half of 2019 was the strain known as Ryuk, and Ryuk has typically been spread by phishing. According to ZDNet, a recent Maritime Safety Information Bulletin issued by the United States Coast Guard addressed a Ryuk incident at a port facility. The facility goes unnamed, but the effects of the attack are both clear and familiar.
“A recent incident involving a ransomware intrusion at a Maritime Transportation Security Act (MTSA) regulated facility. Forensic analysis is currently ongoing but the virus, identified as ‘Ryuk’ ransomware, may have entered the network of the MTSA facility via an email phishing campaign. Once the embedded malicious link in the email was clicked by an employee,” the Bulletin says, “the ransomware allowed for a threat actor to access significant enterprise Information Technology (IT) network files, and encrypt them, preventing the facility’s access to critical files. The virus further burrowed into the industrial control systems that monitor and control cargo transfer and encrypted files critical to process operations. The impacts to the facility included a disruption of the entire corporate IT network (beyond the footprint of the facility), disruption of camera and physical access control systems, and loss of critical process control monitoring systems. These combined effects required the company to shut down the primary operations of the facility for over 30 hours while a cyber-incident response was conducted.”
It’s worth reviewing how extensive the effects of this attack were. Not only were operations interrupted for a very expensive thirty hours, with loss of access to critical information, but the disruption extended to physical security systems--cameras and locks--and even to process monitoring systems. Thus the effects are not just economic, as serious as those were, but in principle affected the safety and security of the facility. Ransomware has become more than the simple risk to business systems it once was. As troublesome as business disruption and loss of data are, once ransomware begins affecting security and process controls, it becomes more than a nuisance: it now represents a threat to safety.
As organizations look to the safety and security of industrial operations, they can no longer overlook the threat that social engineering poses. New school security awareness training, tailored to an organization’s mission and vulnerabilities, can make a big difference.
ZDNet has the story: https://www.zdnet.com/article/us-coast-guard-discloses-ryuk-ransomware-infection-at-maritime-facility/
Gloss