The IT Nerd

The LockBit ransomware gang is claiming responsibility for the January Fulton County Georgia cyber-attack and are threatening to publish “confidential” documents if the ransom is not paid by this Friday.

You might recall that I first brought this story to you on February 1st. But here’s a quick recap.

Initial reports by the county on January 29th acknowledged a “cyber security incident”, confirming widespread system outages, including phone, court and tax systems, but gave no further details.

It wasn’t until yesterday, almost three weeks later and only after LockBit claimed the attack, that officials acknowledged the outage was in fact a ransom attack, but still offered no details on the attack itself. Many of the county’s systems are still down and the investigation is on-going.

Services remaining down include:

• 2/3rd of phone services
• Court systems
• Property tax systems
• Jail IT systems
• Water billing

LockBit has given a deadline of Friday 2/16 for the County to pay the ransom. Fulton county is Georgia’s largest county and home to the state’s capital, Atlanta.

Steve Hahn, Executive VP, BullWall had these thoughts:

   “What we are seeing here is part of a larger trend. Cities all across the US are under attack by Russian threat actors. Oakland declared a state of emergency when nearly all services, all the way to their city hall, were shut down. In that instance the threat actor stole and released data as well. Hundreds of US cities have been the victim of these attacks.

   “In the past these Russian threat actors were strictly financially motivated. Since the war in Ukraine the attacks have become increasingly targeted and not just getting the Ransom but also hurting us financially. Hitting supply chains that could impact inflation, hitting hospitals and cities providing life saving services to maximize the human impact. The other new trend is the threat actor is typically getting command and control access prior to the attack. This means they have admin level rights, they steal data, then set up their ransomware attack in a way that no preventative tool can stop it.

   “We have to recognize that we are truly under attack and if you’re in their crosshairs it’s not “if” but “when” you’ll be hit with Ransomware. We have to shift focus from simply trying to prevent these attacks to also how to contain them quickly to minimize the effect. Containment and recovery are key strategies these cities need to employ so their services aren’t impacted. We need MFA to every server, every session. They need to work towards a zero-trust environment and, most importantly, they need containment and recovery strategies in place. In the same way we “war game” physical attacks, knowing you can’t pin your hopes on “preventing” them, we need to take that same approach to cyber-attacks and assume it’s not “if” but “when” and how do we respond. Cities simply aren’t doing that today.”
   

Emily Phelps, VP, Cyware follows with this comment:

   “Effective cybersecurity is challenging for even the most well-resourced organizations. Local governments have additional resourcing challenges that further complicate protecting the critical data of their citizens.

   “Organizations, across sectors, must become more proactive in their cyber defense strategies. This starts with advanced threat intelligence that can be automatically operationalized across a security team. Context-rich threat intelligence enables security teams to prioritize critical threats and take rapid action. Intelligence sharing organizations (ISACs) are also an important component that can provide relevant intelligence to industry organizations to improve effectiveness and efficiency.”

Given that I started to write about this at the start of this month and the incident is still ongoing shows how devastating and disruptive cyberattacks can be. Which is why prevention and rapid detection of intrusions has to be the way to go to stop from being the next headline.

According to the Feb 15^th report by Group-IB, the malware steals the users facial image with video and stills and gets them to upload the images and PII to their C2 servers. The threat actors have been using “multi-staged social engineering scheme” to persuade victims to install a Mobile Device Management (MDM) profile that gives them full control of the user’s device. The malware affects iOS and Android devices.

According to Group-IB the trojan was found disguising itself in 20 different applications from the Thailand’s government, the financial sector, and utility companies and stealing login credentials from these services.

Approov Mobile Security CEO Ted Miracco offers some thoughts on this malware and attacker’s approach:

   “While the social engineering piece of this attack is common, and stealing facial data isn’t entirely new, the focus on deepfake creation for financial fraud is a concerning and very recent development, that wouldn’t have been possible a couple years ago. This is part of the rapidly evolving threat landscape that are 100% enabled through the use of AI technologies. 

   “At this time, the GoldPickaxe malware can trick users into generating images and videos from their iOS and Android phones. This is not the same as stealing biometric data that is stored on the device’s secure enclave and is encrypted and remains secure. This malware is not breaching the Face ID functionality nor breaching either of the two mobile OSes security features, so at this time there is no reason to fear widespread attacks, and there is no reason to disable biometric support from the apps and phones that enable them. 

   “There are several things that can be done to prevent these kinds of attacks. Endpoint detection and response (EDR) and runtime application self protection (RASP) are solutions specifically designed for mobile devices to detect and respond to malicious activity in real time. 

   “It’s extremely unlikely that “GoldPickaxe” will slow facial recognition development, however, it serves as a wake-up call for responsible development and implementation of security mechanisms to detect deep fakes and other fraud.”

This is pretty scary as it’s always been thought that biometrics are an excellent way to secure your device. Clearly given the existence of this malware, that no longer appears to be the case. And it proves that threat actors will stop at nothing to get what they want.