The IT Nerd

As announced on University of Michigan’s (U-M) website, the day before the new academic year, all its systems and services were taken offline to deal with a cybersecurity incident which caused a widespread impact on online services for classes starting the next day.

Starting on Sunday, a cybersecurity incident caused IT outages and disrupted access to wired and WiFi campus internet, vital online services and email. Despite U-M’s IT team’s attempts to restore the impacted systems, the administration felt it was safest to disconnect the U-M network from the internet due to the severity of the event.

• “We took this action to provide our information technology teams the space required to address the issue in the safest possible manner,” reads the status update from Sunday.

Students rely on the currently offline systems to access class information and to navigate the large campus. Due to the lack of access, various accommodations will be made for students for August.

Emily Phelps, Director, Cyware had this comment:

   “It is a significant decision for any organization to take its systems offline following a cyberattack. For a large university to make this call the day before classes began illustrates the severity of the attack. Whether an organization’s systems are taken down by the attack itself or following the attack to address it safely, the outcome is the same: operational disruption, economic impact, and potential panic. As an industry, we want to enable institutions to move from a reactive to a proactive posture to minimize the need to take their systems offline.”

Dave Ratner, CEO, HYAS follows with this:

   “This attack further proves that no one should consider themselves safe from being targeted. We live in a world where every organization can and will be breached, and the only solution is to focus on proper operational resiliency, business resiliency, and business continuity. As part of this, visibility and observability into anomalies on the network and the early detection of the digital exhaust from a breach is critical so that an attack can be detected, mediated, and rendered inert before widespread damage ensues.  

   “CISA and the NSA don’t just recommend Protective DNS for governments and critical infrastructure — it’s increasingly clear that it is a vital component for every organization and network.”

Education is a high value target in a world where everyone is a high value target to some degree. But they because of being constantly cash constrained don’t often have the resources to make sure that they are fully protected from a cyberattack. That needs to change as this particular attack was pretty crippling. And I can see other attacks at other educational institutions being equally as crippling.

Purfoods has notified more than 1.2 million people that their personal and medical data such as names, SSNs, driver’s license numbers, financial account and/or payment card information, medical information, health information, and DOB may have been stolen from its servers during a cyber-attack occurring between January 16th, 2023, and February 22nd, 2023.

Purfoods, a health-focused food-delivery company that does business under the name Mom’s Meals, works with more than 500 health providers including governments and managed-care organizations in the US and delivers meals to those covered under Medicare and Medicaid, as well as individuals not covered.

The company identified “suspicious account behavior” on February 22nd, 2023, and, according to the notification letter, the attackers gained access to the Purfoods’ network on January 16th. It is still unclear how the criminals accessed the network.

Dave Ratner, CEO, HYAS had this to say:

   “It’s still unclear how the criminals breached the network, but it actually doesn’t matter. Bad actors will continue to create and obfuscate their techniques. The attack demonstrates yet again that no one is safe, and that organizations need to think more about business and operational resiliency than pure prevention. Deploying anomaly visibility and detection as part of a depth-in-depth strategy, such as Protective DNS, is clearly critical today to protect PII and other critical data from being stolen.”

This is bad as this is all the information that a threat actor requires to launch identity theft attacks. Hopefully there’s a full accounting of what happened and what Purfoods is going to do to protect those who are affected.

The FBI has managed to take down the infamous Qakbot ransomware network. And this is no minor takedown by the feds:

The FBI and international partners disrupted the Qakbot botnet — a grouping of computers infected by a malware program that was used to carry out the cyberattacks — and are now working to disable the program on thousands of victim computers, law enforcement officials said.

Dubbed “Operation Duck Hunt,” the effort to take down the botnet system also seized nearly $9 million in cryptocurrency that was collected in criminal ransomware campaigns.

Qakbot’s victims totaled 700,000 across the globe in 2023, according to the Justice Department, with approximately 200,000 located in the U.S. Small businesses, healthcare providers and government agencies including a defense manufacturer base in Maryland were harmed by attacks linked to the network.

And:

As part of “Operation Duck Hunt,” the FBI gained access to the QakBot infrastructure and “redirected” the cyberactivity to servers controlled by U.S. investigators, according to senior FBI and Justice Department officials. Investigators were then able to inject the malware with a program that released the victim computer from the botnet, freeing it of the malicious host.

Law enforcement officials said Tuesday they’re still trying to determine how many of the more than 700,000 computers infected this year were freed from Qakbot’s control and credited close partnership with European investigators for the operation’s success. No one has been arrested as a result of the international probe, but 52 servers were seized, and the investigation is ongoing.

Ken Westin, Field CISO, Panther Labs had this comment on the takedown:

It is interesting the FBI essentially deployed something that almost resembles “hacking back”  to redirect traffic to their servers and ran a script to uninstall the malware on remote systems. It is rare that law enforcement would deploy such measures as there are potential risks of executing commands on remote systems, however, the risk may have been minimal in this case given the threat posed by Qakbot to networks and critical infrastructure. It will be interesting to learn more about the legal case for when such activities can be taken to execute scripts on remote systems when dealing with malware and threats to national security.

In short, the FBI has pwned them. Ingenious. And I have to admit that I am impressed. Clearly even the bad guys are vulnerable to being pwned due to the fact that they didn’t take the proper measures to avoid being pwned. Just like their victims fail to sometimes do.

UPDATE: Dave Ratner, CEO, HYAS had this comment:

   “We applaud the FBI for taking control of the Qakbot malware command-and-control infrastructure; unfortunately, without any arrests, it’s likely that the criminals will setup new adversary infrastructure in the near future.  With dwell time being as little as 24 hours, these attacks highlight once again how critical it is for organizations to have immediate visibility into anomalous network traffic communicating with adversary infrastructure so that they can take control before ransomware impacts operational resiliency, as recommended by CISA and the NSA via Protective DNS solutions.”