Scribd
Upload
39 views3 pages

Targeted Ransomware Attacks

Uploaded by

shreeya
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
39 views3 pages

Targeted Ransomware Attacks

Uploaded by

shreeya
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 3

TARGETED RANSOMWARE ATTACKS

CASE STUDIES-

1. COLONIAL PIPELINE HACK:


 The Colonial Pipeline ransomware attack, which occurred in May 2021, is one of the
most significant cyber incidents in recent U.S. history, impacting critical
infrastructure and leading to widespread fuel shortages.

 The attackers, a group known as DarkSide, gained initial access to Colonial Pipeline's
network through a compromised VPN credential. They stole approximately 100
gigabytes of data within two hours.

 Ransomware was deployed, affecting various IT systems, particularly those related to


billing and accounting. In response, Colonial Pipeline shut down operations to
prevent further spread of the malware.

 The attack disrupted the distribution of gasoline and jet fuel across the East Coast,
which relies on Colonial Pipeline for nearly 45% of its fuel supply. This led to panic
buying and fuel shortages in several states, significantly affecting consumers and
businesses alike.

Following the attack:


 Colonial Pipeline engaged cybersecurity firms like Mandiant to investigate and
recover from the incident.
 The FBI was involved in tracking down the perpetrators and recovering part of the
ransom.
 The incident raised alarms about the vulnerability of critical infrastructure in the
U.S., prompting discussions on enhancing cybersecurity measures across various
sectors.

Security Measures to Prevent the Attack


1. Implementing the Principle of Least Privilege: By restricting user access to only
the data and systems necessary for their roles, Colonial Pipeline could have
limited the potential for attackers to escalate privileges and access sensitive
areas of the network. This would have made it more difficult for DarkSide to
exploit compromised credentials effectively.
2. Multi-Factor Authentication (MFA): Requiring MFA for all remote access
connections would have added an additional layer of security, making it
significantly harder for unauthorized users to gain access even if they had stolen
credential
3. Endpoint Privilege Management (EPM): Implementing EPM solutions could have
prevented ransomware from executing on endpoints by blocking processes that
attempt unauthorized actions, such as file encryption, regardless of user
privileges
4. Network Segmentation: By segmenting the network into smaller, isolated zones,
Colonial Pipeline could have contained any potential ransomware spread,
preventing it from affecting critical systems across the entire infrastructure.
2. Conti ransomware attack on the Costa Rican government,
The Conti ransomware attack on the Costa Rican government, which began in April 2022,
was a significant cyber incident that severely impacted multiple government agencies and
critical services.

 Attack commenced on April 17, 2022, with the initial breach occurring at the Ministry of
Finance on April 18.
 the attackers gained entry through compromised VPN credentials. A member of the Conti
group accessed the network using credentials obtained from malware previously
installed on a compromised device within the government network

Execution of the Attack

 Reconnaissance and Data Exfiltration: After gaining access, Conti operators conducted
reconnaissance to understand the network layout. They utilized tools like Cobalt Strike to
maintain persistence and exfiltrate data. Within days, they had stolen approximately 672 GB
of sensitive information from various government entities.

 Ransom Demand: Initially, Conti demanded a ransom of $10 million, which later increased to
$20 million when the government refused to pay. The group threatened to leak sensitive data
if their demands were not me.

Impact of the Attack

 The attack crippled critical services across several ministries, including customs, taxation,
and social security systems. The Ministry of Finance was particularly affected, rendering
it unable to process tax declarations or manage imports and exports effectively. This
disruption led to an estimated economic loss of around $30 million per day during the
initial stages of the attack

 The attack also affected public employee payroll systems, causing delays in salary
payments and impacting public services nationwide.

 On May 8, 2022, newly elected President Rodrigo Chaves declared a national emergency
in response to the ongoing crisis. This declaration allowed the government to mobilize
resources more effectively to combat the cyber threat and restore services.

 Following the attack, over 600 GB of stolen data was leaked online, which included
sensitive information such as tax returns and personal data of citizens and businesses.
This raised significant concerns about privacy and security among Costa Ricans

- Government was in refusal to Pay Ransom


- Long-term Recovery Efforts

You might also like