Happy new year! And three days into the new year I have my first phishing scam that you need to be aware of. This one is the first that I have personally seen that leverages Microsoft Teams and starts with an email:
So let’s unpack this. If you look at the reply to address, it’s from a domain registered in Switzerland which is a bit different. That may be to gain your confidence if you’re paying attention to that sort of thing, which you should be. Or it could be a “throwaway domain” which the scammer is using. As from who it is sent from:
Well, that’s a bit suspect. Since this doesn’t match the reply to address, this is clearly a scam. But let’s see how far this goes.
If you click on the words “View / Download Sent File From Email Attachment”, which by the way you should never, ever do, you get this:
Well, someone spent a lot of time and effort putting this together as it looks like Microsoft would created. I also note that this web page has your email address automatically added and all you have to do is type in your password. That’s because the link that I referred to earlier has your email address embedded in it and there’s no way to change it on the web page. Thus this implies that this could be a targeted phishing attack called “spear phishing”. But what is clear is that the attack is to get your Office 365 credentials at the very least. There’s likely more to it than that. But I can’t tell you what that “more” is as when I typed in various bogus passwords, I get this error message:
Now it could be that it has captured your Office 365 credentials and someone is going to try them right away to pwn your Office 365 account, or it could be doing something more sophisticated. For example I can see a scenario where these are checked against Office 365 in real time. I’m thinking that it’s more likely the former. But given how phishing attacks have evolved over the last year, anything is possible.
As usual, my advice is that if you get one of these emails, delete it. Don’t click on anything. Just delete it and move on with your life.
Toronto’s Sick Kids Hospital Pwned By Ransomware…. But The Ransomware Provider Apologizes And Provides Free Decryption Software
Posted in Commentary with tags Hacked on January 3, 2023 by itnerdWe do indeed live in strange times. I say that because just before the holidays The Hospital For Sick Children which is also known as Sick Kids Hospital in Toronto was pwned by ransomware:
The Hospital for Sick Children (SickKids) is currently responding to a cybersecurity incident affecting several network systems and has called a Code Grey – system failure. The code went into effect at 9:30 p.m. on Sunday, December 18, and is ongoing.
The safety and well-being of our patients and their families is our top priority. All patient care is continuing and there is currently no evidence that personal information or personal health information has been impacted.
Upon learning of this incident, we immediately activated the hospital’s incident management command centre and launched an investigation to determine the nature and scope of the incident. At this time, the incident appears to have only impacted a few internal clinical and corporate systems, as well as some hospital phone lines and webpages. Downtime procedures have been activated where needed.
Now that’s pretty bad. But there is a plot twist. The ransomware used was LockBit which is ransomware as a service. Or put another way, if you pay LockBit, you can use their ransomware to pwn your target. The thing is that that according to Bleeping Computer, LockBit has terms of service, and whomever launched this attack on Sick Kids violated those terms of service:
As first noted by threat intelligence researcher Dominic Alvieri, two days after SickKids’ latest announcement, the LockBit ransomware gang apologized for the attack on the hospital and released a decryptor for free.
“We formally apologize for the attack on sikkids.ca and give back the decryptor for free, the partner who attacked this hospital violated our rules, is blocked and is no longer in our affiliate program,” stated the ransomware gang.
As for the terms of service the “partner” violated, here they are:
While the ransomware operation allows its affiliates to encrypt pharmaceutical companies, dentists, and plastic surgeons, it prohibits its affiliates from encrypting “medical institutions” where attacks could lead to death.
“It is forbidden to encrypt institutions where damage to the files could lead to death, such as cardiology centers, neurosurgical departments, maternity hospitals and the like, that is, those institutions where surgical procedures on high-tech equipment using computers may be performed,” explains the ransomware operation’s policies.
The stealing of data from any medical institution is allowed per the policies.
According to the ransomware gang, as one of its affiliates encrypted the hospital’s devices, they were removed from the operation, and a decryptor was offered for free.
I have to admit that I have never heard of this sort of thing happening. But here we are. And what makes this even more puzzling is this:
However, this does not explain why LockBit did not provide a decryptor sooner, with patient care being impacted and SickKids working to restore operations since the 18th.
Furthermore, LockBit has a history of encrypting hospitals and not providing encryptors, as was seen in its attack against the Center Hospitalier Sud Francilien (CHSF) in France, where a $10 million ransom was demanded, and patient data eventually leaked.
The attack on the French hospital led to referring patients to other medical centers and postponing surgeries, which could have led to significant risk to patients.
I am going to go out on limb and suggest that the attack on the French hospital might have attracted a lot of unwanted attention on the operators of LockBit. Thus when the Sick Kids incident happened, the LockBit operators might have decided that they quickly needed to walk that back. Regardless, this is one of those rare good news stories in a space where all I tend to report on is bad news.
1 Comment »