The IT Nerd

After weeks of being shut down by a ransomware attack and much deliberation, Washington County Pennsylvania chose to pay the ransom rather than expose their children to possible abuse. That was the explanation given for paying almost $350,000 to a Russian ransomware group.

The county hired a cyber security firm to facilitate the payment of $346,687 to “Russian Hackers.”

Solicitor Gary Sweat said the hackers demanded ransom money or they’d release the hacked data and “We were advised not to make any statements because the cybercriminals were listening in on everything being said.” 

WPXI Pittsburgh reported that Commissioner Larry Maggi voted not to pay the ransom, saying it was “repugnant” to give in to cybercriminals. But Commissioner Nick Sherman who voted to pay the ransom explained that the stolen data was more than just social security numbers and driver’s license numbers. “Some of the info they got was Children and Youth Services information about the children of Washington County… children in severe need of services, children who have been abused, abducted… very sensitive information.”

In exchange for the ransom payment, the County received a decryption key to unlock their servers and a promise of deletion of stolen data.

Commissioner Sherman’s had this closing comment: “When you pay the ransom they go away, and they leave you alone, because they know if they don’t people will continue to not pay ransom.  It’s a business model they follow.”

I’ll come back to this later. But now I will hand this over to Mark Campbell, Sr. Director, Cigent:

   “Ransomware gangs continue to lean in on extortion. It’s no longer about getting the data back via the decryption keys. Many organizations have ways to restore data already, however the threat of releasing sensitive data such as internal communications, customer information, or in this case highly sensitive information about the Children and Youth Services takes the extortion to a new level. Even if the extortion demands are paid, there is no real way to trust that the attackers will earnestly destroy the stolen data. Can we count on honor among these thieves?”

Here’s the deal. You should never, ever pay the ransom. There’s no guarantee that you will get your data back. There’s no guarantee that they won’t come back and attack you again. And there’s no telling what they will do with any data that they stole. This is a really bad move and it may come back to haunt Washington County Pennsylvania.

The LockBit ransomware gang is claiming responsibility for the January Fulton County Georgia cyber-attack and are threatening to publish “confidential” documents if the ransom is not paid by this Friday.

You might recall that I first brought this story to you on February 1st. But here’s a quick recap.

Initial reports by the county on January 29th acknowledged a “cyber security incident”, confirming widespread system outages, including phone, court and tax systems, but gave no further details.

It wasn’t until yesterday, almost three weeks later and only after LockBit claimed the attack, that officials acknowledged the outage was in fact a ransom attack, but still offered no details on the attack itself. Many of the county’s systems are still down and the investigation is on-going.

Services remaining down include:

• 2/3rd of phone services
• Court systems
• Property tax systems
• Jail IT systems
• Water billing

LockBit has given a deadline of Friday 2/16 for the County to pay the ransom. Fulton county is Georgia’s largest county and home to the state’s capital, Atlanta.

Steve Hahn, Executive VP, BullWall had these thoughts:

   “What we are seeing here is part of a larger trend. Cities all across the US are under attack by Russian threat actors. Oakland declared a state of emergency when nearly all services, all the way to their city hall, were shut down. In that instance the threat actor stole and released data as well. Hundreds of US cities have been the victim of these attacks.

   “In the past these Russian threat actors were strictly financially motivated. Since the war in Ukraine the attacks have become increasingly targeted and not just getting the Ransom but also hurting us financially. Hitting supply chains that could impact inflation, hitting hospitals and cities providing life saving services to maximize the human impact. The other new trend is the threat actor is typically getting command and control access prior to the attack. This means they have admin level rights, they steal data, then set up their ransomware attack in a way that no preventative tool can stop it.

   “We have to recognize that we are truly under attack and if you’re in their crosshairs it’s not “if” but “when” you’ll be hit with Ransomware. We have to shift focus from simply trying to prevent these attacks to also how to contain them quickly to minimize the effect. Containment and recovery are key strategies these cities need to employ so their services aren’t impacted. We need MFA to every server, every session. They need to work towards a zero-trust environment and, most importantly, they need containment and recovery strategies in place. In the same way we “war game” physical attacks, knowing you can’t pin your hopes on “preventing” them, we need to take that same approach to cyber-attacks and assume it’s not “if” but “when” and how do we respond. Cities simply aren’t doing that today.”
   

Emily Phelps, VP, Cyware follows with this comment:

   “Effective cybersecurity is challenging for even the most well-resourced organizations. Local governments have additional resourcing challenges that further complicate protecting the critical data of their citizens.

   “Organizations, across sectors, must become more proactive in their cyber defense strategies. This starts with advanced threat intelligence that can be automatically operationalized across a security team. Context-rich threat intelligence enables security teams to prioritize critical threats and take rapid action. Intelligence sharing organizations (ISACs) are also an important component that can provide relevant intelligence to industry organizations to improve effectiveness and efficiency.”

Given that I started to write about this at the start of this month and the incident is still ongoing shows how devastating and disruptive cyberattacks can be. Which is why prevention and rapid detection of intrusions has to be the way to go to stop from being the next headline.

According to the Feb 15^th report by Group-IB, the malware steals the users facial image with video and stills and gets them to upload the images and PII to their C2 servers. The threat actors have been using “multi-staged social engineering scheme” to persuade victims to install a Mobile Device Management (MDM) profile that gives them full control of the user’s device. The malware affects iOS and Android devices.

According to Group-IB the trojan was found disguising itself in 20 different applications from the Thailand’s government, the financial sector, and utility companies and stealing login credentials from these services.

Approov Mobile Security CEO Ted Miracco offers some thoughts on this malware and attacker’s approach:

   “While the social engineering piece of this attack is common, and stealing facial data isn’t entirely new, the focus on deepfake creation for financial fraud is a concerning and very recent development, that wouldn’t have been possible a couple years ago. This is part of the rapidly evolving threat landscape that are 100% enabled through the use of AI technologies. 

   “At this time, the GoldPickaxe malware can trick users into generating images and videos from their iOS and Android phones. This is not the same as stealing biometric data that is stored on the device’s secure enclave and is encrypted and remains secure. This malware is not breaching the Face ID functionality nor breaching either of the two mobile OSes security features, so at this time there is no reason to fear widespread attacks, and there is no reason to disable biometric support from the apps and phones that enable them. 

   “There are several things that can be done to prevent these kinds of attacks. Endpoint detection and response (EDR) and runtime application self protection (RASP) are solutions specifically designed for mobile devices to detect and respond to malicious activity in real time. 

   “It’s extremely unlikely that “GoldPickaxe” will slow facial recognition development, however, it serves as a wake-up call for responsible development and implementation of security mechanisms to detect deep fakes and other fraud.”

This is pretty scary as it’s always been thought that biometrics are an excellent way to secure your device. Clearly given the existence of this malware, that no longer appears to be the case. And it proves that threat actors will stop at nothing to get what they want.