Mass Transit - 16

Transit Cybersecurity
This can significantly increase
the overall costs and risks for public
agencies that become the victims of
a cyber attack. In order to reduce
these risks, they have to get more
proactive about cybersecurity.

How Ransomware
is Changing

Ransomware attacks used to be
relatively straightforward. In a
traditional attack, the hacker
would breach one or two computers on an agency's network, infect
them with a type of malware that
encrypts document files, databases and spreadsheets in order to
render them inaccessible to the
victim and then demand a relatively small ransom on the order
of a few thousand dollars in order
to remove the encryption from
the network. Although victims'
sensitive data was technically
compromised by the malware,
the hackers didn't actually steal
or view this data - they simply
locked it up behind a robust encryption algorithm to force the
organization to pay.
These attacks were bad enough
and cost many organizations a lot
of money, but they were far less
complex than the new attacks
happening today. The new ransomware that is now in wide use
- including Maze, NetWalker, REVil, DoppelPaymer and Ryuk - is
a multi-stage weapon capable of
causing significant damage. Not
only do the victims have to contend with their data and systems
being encrypted, but they must
also now deal with information
theft and the possibility that this
sensitive data will be publicly exposed on the web for other criminals to steal and use in various
frauds. Additionally, as an initial
step in compromising the network, these attackers usually plant
malware that acts as a " backdoor. "
These backdoors allow them to
carry out surveillance on the network ahead of the attack, but they
also provide long-term access to
the organization post-attack. This

16 |

Randy Pargman

A SCREENSHOT
showing Trinity
Metro files posted
by NetWalker,
which targeted
the agency with a
" double extortion "
attack.

means that even after a ransomware attack is " cleaned up " by an
IT security team, these backdoors
could persist inside the system.
The bottom line is that ransomware is no longer just ransomware - it can carry out multistage attacks and data theft that
can be crippling to its victims.

The bottom line

What Happens in
a Double Extortion
Ransomware Attack?

is that ransomware
is no longer just
ransomware - it can
carry out multistage attacks and
data theft that
can be crippling
to its victims.

-RANDY PARGMAN,
Binary Defense

Mass Transit | MassTransitmag.com | NOVEMBER 2020

This attack begins like any normal ransomware attack, usually
with a phishing email to an employee or by exploiting a weak
employee password for a remote
desktop portal that is exposed to
the Internet.
The hacker will trick the employee into clicking on a link
or downloading a malicious attachment (often Word or Excel),
at which point the ransomware
infects that person's computer
and then immediately connects
to the attacker's command and
control server. The intruder then
takes over manual control and
runs commands to map out the
agency's servers and other workstations, looking for ways to spread
across the network. Unlike traditional ransomware campaigns,
which usually rely on a " sprayand-pray " approach, the double

extortion groups often seek out
specific victims that are able to
afford high ransoms and will be
motivated to get systems running
again quickly - such as large corporations and public agencies.
The second stage of the attack
is where double extortion incidents really break away from the
traditional ransomware " business
model. " In a standard ransomware
attack, the malware will automatically seek out important files on
the system where it landed, encrypt
everything it can find and then
demand a payment to remove the
encryption. In a data leak extortion
attack, however, the ransomware
goes one step further by stealing
the information before it encrypts
it. This puts the victim in a considerable bind, because even if they
use backups to recover from the
encryption part of the attack, they
still have no control over what the
hacker does with the stolen data.
These new ransomware attacks also lead to significantly
higher extortion fees. Although
not all the attacks have been made
public, ransom demands in September and October 2020 were often more than $10 million. In one
recently disclosed attack, the REvil ransomware group demanded
a whopping $42-million ransom
from a New York law firm.

http://www.MassTransitmag.com

Mass Transit

Table of Contents for the Digital Edition of Mass Transit