Time was when any ransomware incident would spark a vigorous press and public response. Quick ahead to the current, and the phrase “ransomware” in a headline doesn’t generate almost as a lot curiosity: such assaults have turn out to be commonplace. Nonetheless, they proceed to pose a grave menace to company safety. This evaluate spotlights the largest and most high-profile incidents that occurred in 2023.
January 2023: LockBit assault on the UK’s Royal Mail
The 12 months kicked off with the LockBit group attacking Royal Mail, the UK’s nationwide postal service. The assault paralyzed worldwide mail supply, leaving tens of millions of letters and parcels caught within the firm’s system. On high of that, the parcel monitoring web site, on-line cost system, and several other different companies had been additionally crippled; and on the Royal Mail distribution heart in Northern Eire, printers started spewing out copies of the LockBit group’s distinctive orange ransom observe.
The LockBit ransom observe that printers on the Royal Mail distribution heart started printing in earnest. Supply
As is usually the case with fashionable ransomware assaults, LockBit threatened to submit stolen knowledge on-line until the ransom was paid. Royal Mail refused to pay up, so the information ended up being printed.
February 2023: ESXiArgs assaults VMware ESXi servers worldwide
February noticed an enormous automated ESXiArgs ransomware assault on organizations via the RCE vulnerability CVE-2021-21974 in VMware ESXi servers. Though VMware launched a patch for this vulnerability again in early 2021, the assault left greater than 3000 VMware ESXi servers encrypted.
The assault operators demanded simply over 2BTC (round $45,000 on the time of the assault). For every particular person sufferer they generated a brand new Bitcoin pockets and put its tackle within the ransom observe.
Ransom demand from the unique model of ESXiArgs ransomware. Supply
Simply days after the assault started, the cybercriminals unleashed a brand new pressure of the cryptomalware, making it far more durable to get well encrypted digital machines. To make their actions tougher to hint, in addition they stopped giving out ransom pockets addresses, prompting victims to make contact via the P2P messenger Tox as a substitute.
March 2023: Clop group broadly exploits a zero-day in GoAnywhere MFT
In March 2023, the Clop group started broadly exploiting a zero-day vulnerability in Fortra’s GoAnywhere MFT (managed file switch) software. Clop is well-known for its penchant for exploiting vulnerabilities in such companies: in 2020–2021, the group attacked organizations via a gap in Accelon FTA, switching in late 2021 to exploiting a vulnerability in SolarWinds Serv-U.
In whole, greater than 100 organizations suffered assaults on weak GoAnywhere MFT servers, together with Procter & Gamble, the Metropolis of Toronto, and Neighborhood Well being Methods — one of many largest healthcare suppliers within the U.S.
Map of GoAnywhere MFT servers linked to the web. Supply
April 2023: NCR Aloha POS terminals disabled by BlackCat assault
In April, the ALPHV group (aka BlackCat — after the ransomware it makes use of) attacked NCR, a U.S. producer and servicer of ATMs, barcode readers, cost terminals, and different retail and banking tools.
The ransomware assault shut down the information facilities dealing with the Aloha POS platform — which is utilized in eating places, primarily quick meals — for a number of days.
NCR Aloha POS platform disabled by the ALPHV/BlackCat group. Supply
Primarily, the platform is a one-stop store for managing catering operations: from processing funds, taking on-line orders, and working a loyalty program, to managing the preparation of dishes within the kitchen and payroll accounting. Because of the ransomware assault on NCR, many catering institutions had been compelled to revert to pen and paper.
Might 2023: Royal ransomware assault on the Metropolis of Dallas
Early Might noticed a ransomware assault on municipal companies in Dallas, Texas — the ninth most populous metropolis within the U.S. Most affected had been IT techniques and communications of the Dallas Police Division, and printers on the Metropolis of Dallas community started churning out ransom notes.
The Royal ransom observe printed out via Metropolis of Dallas community printers. Supply
Later that month, there was one other ransomware assault on an city municipality: the goal this time was the Metropolis of Augusta within the U.S. state of Georgia, and the perpetrators had been the BlackByte group.
June 2023: Clop group launches huge assaults via zero-days in MOVEit Switch
In June, the identical Clop group chargeable for the February assaults on Fortra GoAnywhere MFT started exploiting a zero-day vulnerability in one other managed file switch software — Progress Software program’s MOVEit Switch.
This ransomware assault — one of many largest incidents of the 12 months — affected quite a few organizations, together with the oil firm Shell, the New York Metropolis Division of Schooling, the BBC media company, the British pharmacy chain Boots, the Irish airline Aer Lingus, the College of Georgia, and the German printing tools producer Heidelberger Druckmaschinen.
The Clop web site instructs affected firms to contact the group for negotiations. Supply
July 2023: College of Hawaii pays ransom to the NoEscape group
In July, the College of Hawaii admitted to paying off ransomwarers. The incident itself occurred a month earlier when all eyes had been mounted on the assaults on MOVEit. Throughout that point, a comparatively new group going by the title of NoEscape contaminated one of many college departments, Hawaiian Neighborhood Faculty, with ransomware.
Having stolen 65GB of knowledge, the attackers threatened the college with publication. The non-public info of 28,000 individuals was apparently vulnerable to compromise. It was this incontrovertible fact that satisfied the college to pay the ransom to the extortionists.
NoEscape publicizes the hack of the College of Hawaii on its web site. Supply
Of observe is that college workers needed to briefly shut down IT techniques to cease the ransomware from spreading. Though the NoEscape group provided a decryption key upon cost of the ransom, the restoration of the IT infrastructure was anticipated to take two months.
August 2023: Rhysida targets the healthcare sector
August was marked by a sequence of assaults by the Rhysida ransomware group on the healthcare sector. Prospect Medical Holdings (PMH), which operates 16 hospitals and 165 clinics throughout a number of American states, was the group that suffered essentially the most.
The hackers claimed to have stolen 1TB of company paperwork and a 1.3 TB SQL database containing 500,000 social safety numbers, passports, driver’s licenses, affected person medical data, in addition to monetary and authorized paperwork. The cybercriminals demanded a 50BTC ransom (then round $1.3 million).
Ransom observe from the Rhysida group. Supply
September 2023: BlackCat assaults Caesars and MGM casinos
In early September, information broke of a ransomware assault on two of the largest U.S. resort and on line casino chains — Caesars and MGM — in a single stroke. Behind the assaults was the ALPHV/BlackCat group, talked about above in reference to the assault on the NCR Aloha POS platform.
The incident shut down the businesses’ whole infrastructure — from resort check-in techniques to fit machines. Apparently, the victims responded in very other ways. Caesars determined to pay the extortionists $15 million, half of the unique $30 million demand.
MGM selected to not pay up, however fairly to revive the infrastructure by itself. The restoration course of took 9 days, throughout which era the corporate misplaced $100 million (its personal estimate), of which $10 million was direct prices associated to restoring the downed IT techniques.
Caesars and MGM personal greater than half of Las Vegas casinos
October 2023: BianLian group extorts Air Canada
A month later, the BianLian group focused Canada’s flag service, Air Canada. The attackers declare they stole greater than 210GB of varied info, together with worker/provider knowledge and confidential paperwork. Particularly, the attackers managed to steal info on technical violations and safety problems with the airline.
The BianLian web site calls for a ransom from Air Canada Supply
November 2023: LockBit group exploits Citrix Bleed vulnerability
November was remembered for a Citrix Bleed vulnerability exploited by the LockBit group, which we additionally mentioned above. Though patches for this vulnerability had been printed a month earlier, on the time of the large-scale assault greater than 10,000 publicly accessible servers remained weak. That is what the LockBit ransomware took benefit of to breach the techniques of a number of main firms, steal knowledge, and encrypt information.
Among the many big-name victims was Boeing, whose stolen knowledge the attackers ended up publishing with out ready for the ransom to be paid. The ransomware additionally hit the Industrial and Industrial Financial institution of China (ICBC), the biggest industrial financial institution on the earth.
The LockBit web site calls for a ransom from Boeing
The incident badly harm the Australian arm of DP World, a significant UAE-based logistics firm that operates dozens of ports and container terminals worldwide. The assault on DP World Australia’s IT techniques massively disrupted its logistics operations, leaving some 30,000 containers stranded in Australian ports.
December 2023: ALPHV/BlackCat infrastructure seized by legislation enforcement
Towards the top of the 12 months, a joint operation by the FBI, the U.S. Division of Justice, Europol, and legislation enforcement businesses of a number of European international locations disadvantaged the ALPHV/BlackCat ransomware group of management over its infrastructure. Having hacked it, they quietly noticed the cybercriminals’ actions for a number of months, amassing knowledge decryption keys and aiding BlackCat victims.
On this means, the businesses rid greater than 500 organizations worldwide of the ransom menace and saved round $68 million in potential payouts. This was adopted in December by a closing takeover of the servers, placing an finish to BlackCat’s operations.
The joint legislation enforcement operation to grab ALPHV/BlackCat infrastructure. Supply
Numerous statistics in regards to the ransomware group’s operations had been additionally made public. Based on the FBI, throughout the two years of its exercise, ALPHV/BlackCat breached greater than a thousand organizations, demanded a complete of greater than $500 million from victims, and obtained round $300 million in ransom funds.
Methods to guard in opposition to ransomware assaults
Ransomware assaults have gotten extra diversified and complicated with every passing 12 months, so there isn’t (and might’t be) one killer catch-all tip to forestall incidents. Protection measures should be complete. Give attention to the next duties:
