US companies scramble to contain an international ransomware attack | hacking

[ad_1]

Businesses across the United States on Saturday scrambled to contain a ransomware attack that paralyzed computer networks around the world, a situation complicated in the United States by a lack of office staff at the start of the July 4th weekend.

In Sweden, most of the supermarket chain Coop’s 800 stores were unable to open because cash registers were not working, according to public radio. State railways and a major pharmacy chain were also affected.

Cyber ​​security experts said the REvil gang, a large Russian-speaking ransomware syndicate, was behind the attack that targeted a software vendor called Kaseya, using its network management package as a channel to spread ransomware via cloud service providers.

The privately owned Kaseya is based in Dublin with its US headquarters in Miami.

The US Federal Cyber ​​Security and Infrastructure Security Agency (Cisa) said it was closely monitoring the situation and working with the FBI. Cisa urged anyone who might be affected to “follow Kaseya’s instructions to shut down the virtual sysadmin servers immediately.”

The FBI linked REvil with the attack on JBS SA, a major global meat processing company, over Memorial Day weekend in May. Operating since April 2019, the group offers ransomware as a service, which means it develops network-crippling software and rents it to so-called affiliates that infect targets and take the lion’s share of the ransom.

The Brazil-based meat company said it paid the equivalent of $11 million in ransom to hackers, escalating calls by US law enforcement authorities to bring such groups to justice.

Kaseya CEO Fred Fukola said the company believes it has identified the source of the vulnerability and will release this patch as soon as possible to get our customers back up and running.

John Hammond of security firm Huntress Labs said he was aware of a number of managed service providers – companies that host IT infrastructure – that had been hit by ransomware, which encrypts networks so victims pay attackers.

“It is reasonable to believe that this could affect thousands of small businesses,” Hammond said.

Fukula said that fewer than 40 Kaseya customers are known to have been affected, but the ransomware could still affect hundreds of other companies that rely on Kaseya customers who provide IT services more broadly.

Vokula said the problem only affects “in-company” customers, and organizations that run their own data centers. He said it does not affect the cloud-based services that run software for clients, although Kaseya has closed those servers as a precaution.

“Customers who encounter ransomware and receive a call from attackers should not click on any links – they may be weaponised,” the company said.

Cattell Tillman, an analyst at Gartner, said Cassia clearly “reacted with an abundance of caution. But the reality of this event was that it was engineered to achieve maximum impact, combining a supply chain attack with a ransomware attack.”

Supply chain attacks infiltrate widely used software and spread malware while it is automatically updated. Complicating the response this time around is that Kaseya’s attack happened at the start of a major weekend in the US, when most corporate IT teams weren’t fully equipped.

That could leave organizations unable to address other vulnerabilities, such as a critical Microsoft bug affecting print job software, said James Shank, a threat intelligence analyst.

“Castle clients are in the worst possible situation,” he said. “They are racing against time to get updates on other critical bugs.”

“It is reasonable to believe that the timing was planned” for the holiday, Shank said.

[ad_2]