Jump to content

Colossal Ransomware Attack


Poolflood

Recommended Posts

https://www.npr.org/2021/07/03/1012849198/ransomware-cyber-attack-revil-attack-huntress-labs

 A ransomware attack paralyzed the networks of at least 200 U.S. companies on Friday, according to a cybersecurity researcher whose company was responding to the incident.

 

Some cybersecurity experts predicted that it might be hard for the gang to handle the ransom negotiations, given the large number of victims — though the long U.S. holiday weekend might give it more time to start working through the list.

Link to comment
Share on other sites

Guest Lobo

The Russians only got the internet and code-breaking ransomeware capabilities in the last 5 months.  It's not like this was some pre-meditated collaborative attack

Link to comment
Share on other sites

9 minutes ago, Lobo said:

The Russians only got the internet and code-breaking ransomeware capabilities in the last 5 months.  It's not like this was some pre-meditated collaborative attack

Can you expand on this? I do not understand what this means.

Link to comment
Share on other sites

Guest Lobo

Maybe not this particular incident was not all Russia, but it does seem like Russia has had a hand in attacks like this as of late.  It may have been influenced by geopolitics.  Maybe.   

Link to comment
Share on other sites

35 minutes ago, NeverMarryAStripper said:

It’s long past time to use the full power and force this country can muster to deal with these fucksticks

Or pay 100 bucks to a large irritable Chechen for each Russian hacker geek he tracks down and treats as a punching bag.

  • Hook 'Em 5
  • Like 2
Link to comment
Share on other sites

44 minutes ago, NeverMarryAStripper said:

It’s long past time to use the full power and force this country can muster to deal with these fucksticks

Drone strike on the building the fucksticks are operating out of is pretty easy to justify. Russia is at war with us, we're just pretending it's ok because it's not physical.

  • Hook 'Em 2
Link to comment
Share on other sites

If there's money to be made hacking, people will hack. We can nuke Russia and the hacks will come from somewhere else. Same reason people still rob banks. The reality is there are too many stupid people working in corporations clicking on phishing emails, etc....

I work for a software company and have to complete monthly cybersecurity awareness e-learning modules. And instead of just listing the do's and dont"s, the modules are wrapped in cheesy sitcom like  vignettes or games, because otherwise, apparently they an trust people to participate. It's clear our company leadership is paranoid as fu k about this shit happening to us. Which makes the rumor that our CEO got fished more amusing. 

  • Hook 'Em 2
Link to comment
Share on other sites


We get fake phishing emails all the time from our IT security and they’ve gotten very good at crafting them to look real. Used to be on the 3rd strike you’d have to take extra training. Now the first strike wipes out your next scheduled raise. 2nd time and you’re fired. A random attack is one of the major fears at our company and they’re no longer fucking around with dumb ass employees.

Damn that’s pretty hard core
Link to comment
Share on other sites

33 minutes ago, Blotto said:

If there's money to be made hacking, people will hack. We can nuke Russia and the hacks will come from somewhere else. Same reason people still rob banks. The reality is there are too many stupid people working in corporations clicking on phishing emails, etc....

I work for a software company and have to complete monthly cybersecurity awareness e-learning modules. And instead of just listing the do's and dont"s, the modules are wrapped in cheesy sitcom like  vignettes or games, because otherwise, apparently they an trust people to participate. It's clear our company leadership is paranoid as fu k about this shit happening to us. Which makes the rumor that our CEO got fished more amusing. 

I used to work for a Fortune 500 company.  My boss’ brother was head of cyber security.  Over drinks he told us that the CEO fell for every fake phishing email sent to him.  They were not subtle, I identified every one in 2 seconds by reading the subject line.

Link to comment
Share on other sites

19 minutes ago, conVINCEd said:

I used to work for a Fortune 500 company.  My boss’ brother was head of cyber security.  Over drinks he told us that the CEO fell for every fake phishing email sent to him.  They were not subtle, I identified every one in 2 seconds by reading the subject line.

to be fair, most IT departments have become much, much better at sending non-obvious phishing traps.       Its not " Clikc here Mr empoylee, free vacaton" anymore. 

 

in the last year I have emails that purport to be from the HR team asking for company feedback... but the clue was  to preview the link provided, which was taking you to a 3rd party page that didnt seem right. (and the email was from a "one letter difference" domain)   Or emails from THE CEO that name the company CEO telling everyone to check on their upcoming raises..... that one got like half the fucking company.      never underestimate the complete lack of intelligence re: security when good old fashioned greed gets involved.  IT had to explain to everyone that the CEO name is easily found and any phisher worth a damn would be able to try that. 

Important to note that we are tested on exact copies of phish emails have actually WORKED for real in the real world (at other companies) which is how they got the template.

 

Our team gets graded on how many times we mark the emails as phish spam.... every so often someone gets got.... but, other than the money one, we do very well..... except.... we've got a 69/70 year old lady whos worked for the company for 20+ years on our team....  She is so kind, and helps out anytime you ask her and shes always mentoring new hires.  But,she has basically been caught every single time.   Shes gone through at least 5 trainings lasting more than 2 hours showing her what to look for, but she gets so behind every morning, that by the end of the day shes opening emails without even bothering to see who the fuck they are from and double clicking every attachment or link.   

I dont even think firing her is on the table... but its amazing how she gets tricked on every fucking test, every month. 

Edited by AUS-97HORN
  • Hook 'Em 3
Link to comment
Share on other sites

2 hours ago, Poolflood said:

https://www.npr.org/2021/07/03/1012849198/ransomware-cyber-attack-revil-attack-huntress-labs

 A ransomware attack paralyzed the networks of at least 200 U.S. companies on Friday, according to a cybersecurity researcher whose company was responding to the incident.

Some cybersecurity experts predicted that it might be hard for the gang to handle the ransom negotiations, given the large number of victims — though the long U.S. holiday weekend might give it more time to start working through the list.

at some point, even actual journalism shops like npr will learn to stop writing sensational headlines and learn to distinguish the difference between one attack on the ecosystem of a single company (in this case kaseya), and a simultaneous attack on 200 companies, which this is not.

  • Hook 'Em 2
Link to comment
Share on other sites

2 minutes ago, AUS-97HORN said:

to be fair, most IT departments have become much, much better at sending non-obvious phishing traps.       Its not " Clikc here Mr empoylee, free vacaton" anymore. 

 

in the last year I have emails that purport to be from the HR team asking for company feedback... but the clue was  to preview the link provided, which was taking you to a 3rd party page that didnt seem right. (and the email was from a "one letter difference" domain)   Or emails from THE CEO that name the company CEO telling everyone to check on their upcoming raises..... that one got like half the fucking company.      never underestimate the complete lack of intelligence re: security when good old fashioned greed gets involved.  IT had to explain to everyone that the CEO name is easily found and ny phisher worth a damn would be able to try that. 

Important to note that we are tested on exact copies of phish emails have actually WORKED for real in the real world (at other companies) which is how they got the template.

 

Our team gets graded on how many times we mark the emails as phish spam.... every so often someone gets got.... but, other than the money one, we do very well..... except.... we've got a 70 year old lady whos worked for the company for 20+ years on our team.... she has basically been caught every single time.   Shes gone through at least 5 trainings lasting more than 2 hours showing her what to look for, but she gets so behind every morning, that by the end of the day shes opening emails without even bothering to see who the fuck they are from and double clicking every attachment or link.   

I dont even think firing her is on the table... but its amazing how she gets tricked on every fucking test, every month. 

This was about 5 years ago.  They were obvious.  The CEO was a moron who stumbled his way up the corporate ladder.  If I got hammered and took out a police cruiser and impregnated my assistant within a 6 month span I would’ve been shown the door.  He was teflon.  He had the goods on a few people.

  • Like 1
Link to comment
Share on other sites

1 hour ago, Blotto said:

If there's money to be made hacking, people will hack. We can nuke Russia and the hacks will come from somewhere else. Same reason people still rob banks. The reality is there are too many stupid people working in corporations clicking on phishing emails, etc....

I work for a software company and have to complete monthly cybersecurity awareness e-learning modules. And instead of just listing the do's and dont"s, the modules are wrapped in cheesy sitcom like  vignettes or games, because otherwise, apparently they an trust people to participate. It's clear our company leadership is paranoid as fu k about this shit happening to us. Which makes the rumor that our CEO got fished more amusing. 

we get fake emails at least once a month.  Deliberate phishy type emails from our IT dept..

 

If shit doesn't look right, I delete it.  If it's important, they'll send it again.  If it's really important( and proper) they'll list a phone number and I can verify who the fuck they are.

Link to comment
Share on other sites

Guest Lobo
10 minutes ago, staboner said:

lets build more bombs, planes, walls and shit. that'll do it!

Crack wise all you want, but firewalls prevent these types of cyber attacks.  If Texas can pony up the cash to finish it, a border firewall will keep attacks like this from happening from our south.  Our most vulnerable points in Texas, and really nationwide, are our Southern borders.  Also, the Yukon.  

Link to comment
Share on other sites

2 hours ago, Blotto said:

If there's money to be made hacking, people will hack. We can nuke Russia and the hacks will come from somewhere else. Same reason people still rob banks. The reality is there are too many stupid people working in corporations clicking on phishing emails, etc....

I work for a software company and have to complete monthly cybersecurity awareness e-learning modules. And instead of just listing the do's and dont"s, the modules are wrapped in cheesy sitcom like  vignettes or games, because otherwise, apparently they an trust people to participate. It's clear our company leadership is paranoid as fu k about this shit happening to us. Which makes the rumor that our CEO got fished more amusing. 

If instead of getting paid you got a drone strike up your ass I think a lot fewer people would try it

  • Hook 'Em 1
  • Haha 1
Link to comment
Share on other sites

Characteristics of REvil that appear to be operational security mistakes by the malware authors enabled CTU researchers to technically link the REvil and GandCrab ransomware families. This link indicates that the malware authors have shifted their focus from GandCrab to REvil.

~ https://www.secureworks.com/blog/revil-the-gandcrab-connection

Link to comment
Share on other sites

Characteristics of REvil that appear to be operational security mistakes by the malware authors enabled CTU researchers to technically link the REvil and GandCrab ransomware families. This link indicates that the malware authors have shifted their focus from GandCrab to REvil.
~ https://www.secureworks.com/blog/revil-the-gandcrab-connection

Tried to trick us with that link huh?
Link to comment
Share on other sites

2 hours ago, CooterBrown said:


We get fake phishing emails all the time from our IT security and they’ve gotten very good at crafting them to look real. Used to be on the 3rd strike you’d have to take extra training. Now the first strike wipes out your next scheduled raise. 2nd time and you’re fired. A random attack is one of the major fears at our company and they’re no longer fucking around with dumb ass employees.

Damn not sure my company would have anyone left. I can't believe how dumb some end users are 

  • Haha 1
Link to comment
Share on other sites

2 hours ago, Hagbard Celine said:

at some point, even actual journalism shops like npr will learn to stop writing sensational headlines and learn to distinguish the difference between one attack on the ecosystem of a single company (in this case kaseya), and a simultaneous attack on 200 companies, which this is not.

Neurotic People's Radio

National Paranoia Radio

Link to comment
Share on other sites

4 hours ago, Lobo said:

Maybe not this particular incident was not all Russia, but it does seem like Russia has had a hand in attacks like this as of late.  It may have been influenced by geopolitics.  Maybe.   

Most of these are run by Russian organized crime. It's their business model and it brings in hundreds of millions of dollars for a relatively small investment. They have been doing this for a long time.

Basically they are criminals doing criminal things. Geopolitics doesn't need to be a motivation just a lot of money.

 

  • Hook 'Em 2
Link to comment
Share on other sites

2 hours ago, conVINCEd said:

I used to work for a Fortune 500 company.  My boss’ brother was head of cyber security.  Over drinks he told us that the CEO fell for every fake phishing email sent to him.  They were not subtle, I identified every one in 2 seconds by reading the subject line.

"CLICK HERE TO GROW YOUR COCK TO AN 8 INCH ARMADILLO"

  • Haha 3
Link to comment
Share on other sites

5 minutes ago, Gil Bang said:

"CLICK HERE TO GROW YOUR COCK TO AN 8 INCH ARMADILLO"

If you would like to settle for an armadillo cock go right ahead.  The offerings at my local convenience store would lead me to believe that the rhino is the unofficial animal mascot for a longer, harder dick.

Link to comment
Share on other sites

7 hours ago, conVINCEd said:

If you would like to settle for an armadillo cock go right ahead.  The offerings at my local convenience store would lead me to believe that the rhino is the unofficial animal mascot for a longer, harder dick.

You must not like curing leprosy. Panty dropping at its finest...along with an arm.

Link to comment
Share on other sites

16 hours ago, conVINCEd said:

This was about 5 years ago.  They were obvious.  The CEO was a moron who stumbled his way up the corporate ladder.  If I got hammered and took out a police cruiser and impregnated my assistant within a 6 month span I would’ve been shown the door.  He was teflon.  He had the goods on a few people.

GIF by Giffffr

  • Hook 'Em 1
Link to comment
Share on other sites

Didn't hear anything about this over the weekend, WSJ has an article about it today

https://www.wsj.com/articles/ransomware-hackers-demand-70-million-to-unlock-computer-in-widespread-attack-11625524076?mod=hp_lead_pos4


 

Spoiler

 

In case that is paywalled

Quote

Ransomware Hackers Demand $70 Million to Unlock Computers in Widespread Attack

Kaseya CEO tells White House there is no evidence that critical infrastructure was impacted by attack on some of his company’s customers

By 
Robert McMillan

Updated July 5, 2021 7:23 pm ET

The boss of the company at the heart of a widespread hack that has affected hundreds of businesses said he briefed the White House and that attackers are demanding a single $70 million ransomware payment.

The cyberattack that started to unfold Friday is estimated to have hit hundreds of mostly small and medium-size businesses and tens of thousands of computers. It quickly set off alarms in U.S. national security circles over concern that it could have far-reaching effects.

On Monday, Fred Voccola, the chief executive of Kaseya Ltd., whose software was targeted in the attack, spoke with Deputy National Security Advisor Anne Neuberger about the event while the company was still scrambling to restore services to its customers, Mr. Voccola said. Mr. Voccola told the White House that Kaseya wasn’t aware of any critical infrastructure that had been hit by the ransomware or of any victims related to national security, he said in an interview Monday.

A White House spokeswoman didn’t immediately comment.

 

The hackers behind the ransomware attack said that, upon payment, they will release a “universal decryptor” that would unlock computers that had been encrypted and rendered unusable by the attack, according to a note posted to the group’s website Sunday. Mr. Voccola declined to discuss the payment issue.

The ransomware incident has raised concerns because Kaseya’s VSA software is used by many technology companies to provide computer management services, potentially providing a gateway to other victims. The attack locked up computers at schools in New Zealand and locked up cash registers at Coop, a Swedish grocery store chain that was forced to shut some outlets.

Mr. Voccola said that corporate systems at Kaseya hadn’t been compromised during the attack, but that the company protectively shut down the servers providing its online services. Employees have been working through the weekend to restore services and test and release a patch to users of its VSA software that will fix the issues exploited by the hackers, he said. That patch should be released within “hours,” Mr. Voccola said Monday afternoon.

The hackers were able to distribute ransomware by exploiting several vulnerabilities in the VSA software, a Kaseya spokeswoman said.

One of them, discovered by a Dutch security researcher, was in the process of being patched by Kaseya before the ransomware attack occurred, said Victor Gevers, chairman of the volunteer-run security group, the Dutch Institute for Vulnerability Disclosure.

“Kaseya understood the problem and they were rushing to produce a patch,” Mr. Gevers said. Mr. Gevers said the bug was due to a simple error in the company’s code.

About 50 of Kaseya’s customers were compromised and about 40 of those customers were sellers of IT services, known as managed service providers, Mr. Voccola said. By breaking into MSP’s, the hackers were able to expand their impact, performing what security experts call a supply-chain attack.

Security companies estimate that hundreds of organizations, all of them customers of those 40 or so service providers, have now been hit by the ransomware, making it one of the most widespread incidents to date. But almost all of them are small and medium-size organizations, cybersecurity experts said, with the impact often not immediately apparent to the wider public.

“A typical MSP has—ballpark—about 40 end-customers. The average one of their customers has about 20 endpoints and not all of the endpoints were even breached,” Mr. Voccola said in reference to the managed service providers. “It’s still too many, don’t get me wrong.”


Concerns about ransomware are at an all-time high, following extremely disruptive attacks on the Colonial Pipeline and food processor JBS SA .

In May, President Biden ordered U.S. agencies and software contractors that supply them to boost their defenses against cyberattacks that officials have said pose a growing threat to national security and public safety.

The hackers behind the latest incident are known as the REvil ransomware group. They are asking for $70 million to unlock all the affected systems but victims of the group can also pay amounts varying between $25,000 and $5 million directly to unlock their systems even if nobody pays the $70 million.

On Friday, REvil claimed to have infected 40,000 computers. By Sunday, that claim had ballooned to 1 million, a claim many cybersecurity experts treated with skepticism.

“One million seems like an enormous overestimate,” said Brett Callow, a threat analyst for cybersecurity company Emsisoft.

When reached through an intermediary, REvil declined to comment. “We don’t need a lot of noise. Only money,” one of the group’s members told the intermediary, the person said.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency advised Kaseya users to shut down their VSA servers on Friday and has been monitoring the situation.

President Biden over the weekend told reporters that he had been briefed on the attack and that U.S. officials were trying to determine the extent of the Russian government’s involvement. He added that he has warned Russian President Vladimir Putin that the U.S. would respond to Russian government-sponsored cyberattacks. At a recent summit with Mr. Putin, the U.S. president addressed cybersecurity and said critical infrastructure should be off-limits to attacks.

With this latest attack, REvil, which about a month ago collected a $11 million payment from JBS, appears to be signaling that it has not been deterred.

“Ever since Colonial, they have indicated that they are not backing down and they’re going to be even more focused on U.S. targets,” said Chris Krebs, a partner at the security consulting firm Krebs Stamos Group LLC. “What we’re seeing here is some signaling from the actors that these guys are here to stay.”


 

 

Link to comment
Share on other sites

On 7/3/2021 at 8:22 PM, AUS-97HORN said:

to be fair, most IT departments have become much, much better at sending non-obvious phishing traps.       Its not " Clikc here Mr empoylee, free vacaton" anymore. 

 

in the last year I have emails that purport to be from the HR team asking for company feedback... but the clue was  to preview the link provided, which was taking you to a 3rd party page that didnt seem right. (and the email was from a "one letter difference" domain)   Or emails from THE CEO that name the company CEO telling everyone to check on their upcoming raises..... that one got like half the fucking company.      never underestimate the complete lack of intelligence re: security when good old fashioned greed gets involved.  IT had to explain to everyone that the CEO name is easily found and any phisher worth a damn would be able to try that. 

Important to note that we are tested on exact copies of phish emails have actually WORKED for real in the real world (at other companies) which is how they got the template.

 

Our team gets graded on how many times we mark the emails as phish spam.... every so often someone gets got.... but, other than the money one, we do very well..... except.... we've got a 69/70 year old lady whos worked for the company for 20+ years on our team....  She is so kind, and helps out anytime you ask her and shes always mentoring new hires.  But,she has basically been caught every single time.   Shes gone through at least 5 trainings lasting more than 2 hours showing her what to look for, but she gets so behind every morning, that by the end of the day shes opening emails without even bothering to see who the fuck they are from and double clicking every attachment or link.   

I dont even think firing her is on the table... but its amazing how she gets tricked on every fucking test, every month. 

Sounds like she shouldn't have email. Seriously. A valuable employee who could take the company down because she just doesn't understand one thing, so take the one thing away from her. Hell, she'd probably be happier not having to check email. Is printing stuff out for her not an option?

  • Like 1
Link to comment
Share on other sites

Guest Lobo

My Carrier Pigeon service finally get funding this morning!  

Moments later though, an impostor pigeon showed up to my office with the correct password, but different tail markings.  

As a show of force, we cut off its head and had one of our pigeons fly it back to wherever it came from.

Link to comment
Share on other sites

IT security is like the old adage, "You don't have to be faster than the bear, only faster than your slowest friend". Or the simple act of just locking your car door.

 

If you take a pretty much "just-over-the-bare-minimum" approach to securing your shit, the hackers will likely move on to one of the plethora of agencies/companies that don't lift a damn finger.

If you have a bunch of fucksticks that fall for phishing, there is literally no excuse whatsoever to have not implemented a two factor authentication at this point.

Simply applying patches to your servers and endpoints in a timely manner is probably putting a network ahead of the vast majority of the masses.

Its a giant case of the ID Ten-T error.

 

 

  • Hook 'Em 1
Link to comment
Share on other sites

On 7/3/2021 at 7:52 PM, CooterBrown said:


We get fake phishing emails all the time from our IT security and they’ve gotten very good at crafting them to look real. Used to be on the 3rd strike you’d have to take extra training. Now the first strike wipes out your next scheduled raise. 2nd time and you’re fired. A random attack is one of the major fears at our company and they’re no longer fucking around with dumb ass employees.

Is IT following the same termination rules when they or one of their selected vendors screw up?  :)

Seems like the CIO should be willing to quit without contractual benefits when his group make a mistake.

Edited by Nice Guy Eddie
Link to comment
Share on other sites

On 7/3/2021 at 9:02 PM, Lobo said:

Crack wise all you want, but firewalls prevent these types of cyber attacks.  If Texas can pony up the cash to finish it, a border firewall will keep attacks like this from happening from our south.  Our most vulnerable points in Texas, and really nationwide, are our Southern borders.  Also, the Yukon.  

Actually no, firewalls do not prevent this kind of attack.

I won't comment much about your wall comment other than it's the same as a company firewall. Sure, a firewall (wall) will help keep your infrastructure (border) safe to an extent, but there is a hell of a lot more investment and security needed to keep your organization safe.

Link to comment
Share on other sites

On 7/3/2021 at 8:30 PM, conVINCEd said:

This was about 5 years ago.  They were obvious.  The CEO was a moron who stumbled his way up the corporate ladder.  If I got hammered and took out a police cruiser and impregnated my assistant within a 6 month span I would’ve been shown the door.  He was teflon.  He had the goods on a few people.

Was That Wrong? | Epsilon Theory

Link to comment
Share on other sites

16 minutes ago, Lobo said:

No, see.  My firewall will be an actual wall so no viruses or ransomware can infiltrate our private enterprise, our state agencies, our power grid.  It's a literal wall that'll be impenetrable (unlike South Austin's Mom).  $18.4bn and we are totally safe from outside threats.  

can you lite it on fire? I like this fire-wall idea. Very medieval. 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...