The five most important ransomware attacks of 2021

A sur­vey of more than 3,500 glob­al tech­nol­o­gy lead­ers has con­firmed what many already sus­pect­ed: ran­somware attacks are spi­ral­ing out of con­trol. 

The threat analy­sis unit involved iden­ti­fied a 900% rise in ran­somware attacks com­pared to the first six months of 2020. This ties in with an analy­sis of all secu­ri­ty inci­dents report­ed to the UK Infor­ma­tion Commissioner’s Office in the first six months of 2021, com­piled by cyber secu­ri­ty aware­ness and data ana­lyt­ics com­pa­ny Cyb­Safe, which revealed that 22% were ran­somware. That’s dou­ble the num­ber for the same peri­od in 2020. 

Busi­ness­es either pay a small­er amount up front by invest­ing prop­er­ly in secu­ri­ty or much more lat­er deal­ing with the effects of an attack

Things have cer­tain­ly changed since the idea of ran­somware first emerged as long ago as 1989 when the AIDS Tro­jan demand­ed $189 from con­sumers to decrypt their locked-down doc­u­ments. Con­sumers are no longer in the crosshairs and ran­somware is the most lucra­tive of cyber­crime endeav­ours. The gangs behind the attacks are high­ly organ­ised crim­i­nal oper­a­tions, employ­ing affil­i­ates who infil­trate cor­po­rate net­works to earn a per­cent­age of any suc­cess­ful ran­som demand.

With those ran­soms reg­u­lar­ly in the mil­lions – one vic­tim report­ed­ly paid $40m this year – it’s hard­ly sur­pris­ing that attacks con­tin­ue to rise. Here are five of the most impor­tant attacks so far in 2021, along with the lessons to be learned from each.

1. Colonial Pipeline

Date: 7 May 2021

Per­pe­tra­tor: Dark­Side

Ran­som Demand­ed: $5m

Ran­som Paid: $4.4m (75 bit­coin at time of pay­ment although $2.3m was lat­er recov­ered)

Attack vec­tor: Accord­ing to a Bloomberg inves­ti­ga­tion the attack was facil­i­tat­ed by a sin­gle com­pro­mised vir­tu­al pri­vate net­work (VPN) account pass­word.

Note­wor­thi­ness: This attack showed how even crit­i­cal nation­al infra­struc­tures like the largest oil sup­ply pipeline in the US are not immune to ran­somware threats. Fuel short­ages led to pan­ic buy­ing and high­er prices across many days; the aver­age con­sumer was as much a vic­tim as Colo­nial Pipeline.

CIO take­away: No mat­ter what indus­try, what sec­tor or ver­ti­cal, you are in the crosshairs of ran­somware threat actors. Ran­somware is no longer a niche tech­ni­cal issue – it’s a core busi­ness secu­ri­ty con­cern. 

“Mul­ti­fac­tor authen­ti­ca­tion on all remote access ser­vices would have guard­ed against the suc­cess­ful attack vec­tor used in this instance,” says Chris Sedg­wick, direc­tor of secu­ri­ty oper­a­tions at Tal­ion. 

Anoth­er mit­i­ga­tion would have been imple­ment­ing strong net­work seg­re­ga­tion to reduce the poten­tial for an attack­er to piv­ot from IT to OT infra­struc­ture. “This includes mak­ing use of seg­men­ta­tion of envi­ron­ments as well as adopt­ing a zero-trust net­work archi­tec­ture which only allows users access to the net­works they need,” Sedg­wick says.

2. Kaseya

Date: 2 July 2021

Per­pe­tra­tor: REvil

Ran­som Demand­ed: $70m

Ran­som Paid: None: uni­ver­sal decryp­tion key was obtained on 22 July through a “trust­ed third par­ty”, appar­ent­ly with­out charge.

Attack vec­tor: Pre­vi­ous­ly unknown “zero-day” vul­ner­a­bil­i­ties in Kaseya’s Vir­tu­al Sys­tem Admin­is­tra­tor (VSA) soft­ware

Note­wor­thi­ness: This was the very def­i­n­i­tion of a sup­ply chain attack. The VSA remote soft­ware used by at least 50 direct cus­tomers of man­aged ser­vice provider Kaseya led to as many as 1,500 of their cus­tomers falling vic­tim to the ran­somware. 

CIO take­away: First of all, take own­er­ship of an inci­dent prompt­ly. Kaseya alert­ed all cus­tomers on 2 July and advised them to shut down admin­is­tra­tive access to VSA. It then took its own servers and data cen­tres offline. A patch was released on 11 July. 

“Remote mon­i­tor­ing and man­age­ment (RMM) soft­ware access should be restrict­ed and not avail­able over the inter­net,” advis­es Mar­tin Riley, direc­tor of man­aged secu­ri­ty ser­vices at Bridewell Con­sult­ing. “More focus needs to be giv­en to the sup­ply chain, with sup­pli­ers reg­u­lar­ly reviewed to pre­vent out­sourc­ing a secu­ri­ty inci­dent,” he adds. Final­ly, apply­ing appro­pri­ate priv­i­leges to users and updates can mit­i­gate the impact of vul­ner­a­bil­i­ties in soft­ware that has admin rights on cus­tomer sys­tems.

3. Ireland’s Health Service Executive (HSE)

Date: 14 May 2021

Per­pe­tra­tor: Con­ti (Wiz­ard Spi­der)

Ran­som Demand­ed: $20m 

Ran­som Paid: None

Attack vec­tor: Uncon­firmed. A Cyjax threat intel­li­gence report sug­gests Trick­Bot, Ice­dID or Bazar­Loader mal­ware – usu­al­ly exe­cut­ed through phish­ing attacks. 

Note­wor­thi­ness: This attack reminds us that these crim­i­nal gangs are only inter­est­ed in mon­ey and not even a nation’s health ser­vice is off the table. The response to the attack, which caused health ser­vice dis­rup­tion for many weeks, is also note­wor­thy: the HSE and Irish Gov­ern­ment made clear that no ran­som would be paid from the out­set.

CIO take­away: “Wiz­ard Spi­der admit­ted to being in the HSE’s sys­tems for near­ly two weeks before launch­ing their attack,” says Matthew Gracey-McMinn, head of threat research at mali­cious bot-mit­i­ga­tion spe­cial­ists, Netacea. “It seems prob­a­ble that unpatched sys­tems were exploit­ed.” The key take­away, then, is that busi­ness­es need prop­er invest­ment in secu­ri­ty. 

The HSE may have boost­ed its rep­u­ta­tion by not pay­ing the ran­som, but did not escape free of charge. Its CEO, Paul Reid, told an Irish gov­ern­ment health com­mit­tee that imme­di­ate costs were €100m, but could ulti­mate­ly exceed €500m. “Busi­ness­es either pay a small­er amount up front by invest­ing prop­er­ly in secu­ri­ty or much more lat­er deal­ing with the effects of an attack,” Gracey-McMinn warns.

4. Brenntag

Date: 26 April 2021

Per­pe­tra­tor: Dark­Side

Ran­som Demand­ed: $7.5m

Ran­som Paid: $4.4m

Attack vec­tor: Stolen cre­den­tials

Note­wor­thi­ness: The poten­tial use of an ini­tial access bro­ker (IAB) to gain entry to the net­work and exe­cute the ran­somware attack illus­trates one of the most exploit­ed cyber-attack method­olo­gies today. An IAB sells com­pro­mised cre­den­tials to the high­est bid­der, often ran­somware gangs.

CIO take­away: Bren­ntag, a Ger­man chem­i­cal dis­tri­b­u­tion com­pa­ny oper­at­ing in more than 70 coun­tries, chose to pay the mul­ti­mil­lion dol­lar ran­som. 

How­ev­er, the most impor­tant finan­cial trans­ac­tion from a CIO per­spec­tive was that used by the attack­ers: the pur­chase of stolen cre­den­tials. The attack­ers admit­ted to this on their “new cus­tomer” site on the dark web. Peter Yapp, a part­ner at cyber­se­cu­ri­ty and risk con­sul­tan­cy Schillings, notes that “they even help­ful­ly rec­om­mend­ed bet­ter anti-virus, two-fac­tor authen­ti­ca­tion and back­ups kept on tape” as mit­i­ga­tion against future attacks. 

CIOs should ensure their organ­i­sa­tions “do the fun­da­men­tals of cyber­se­cu­ri­ty to keep attack­ers out,” Yapp con­tin­ues, includ­ing “good aware­ness train­ing so users can spot most phish­ing attempts, strong pass­words used and audit­ed reg­u­lar­ly, mul­ti-fac­tor authen­ti­ca­tion and scan­ning for vul­ner­a­bil­i­ties, as well as mak­ing sure all soft­ware is patched up to date”.

5. CNA Financial

Date: 21 March 2021

Per­pe­tra­tor: Phoenix

Ran­som Demand­ed: Unknown

Ran­som Paid: Uncon­firmed (report­ed to be $40m by peo­ple close to the inci­dent)

Attack vec­tor: Unknown

Note­wor­thi­ness: Two things stand out about this attack. First, the size of the ran­som report­ed­ly paid; while this has not been con­firmed by CNA, it would be the largest known ran­som pay­ment to date. Sec­ond, the use of ran­somware called PhoenixLock­er devel­oped by Evil Corp; the lat­ter was made sub­ject to US gov­ern­ment sanc­tions in 2019, pre­vent­ing legal pay­ment of any ran­som. CNA told a reporter at secu­ri­ty pub­li­ca­tion Bleep­ing­Com­put­er that the threat actor respon­si­ble was Phoenix and “not a sanc­tioned enti­ty”.

CIO take­away: Although the ini­tial attack vec­tor has not been offi­cial­ly con­firmed, it is thought to have used a mali­cious brows­er update deliv­ered via a legit­i­mate web­site, accord­ing to David Carmiel, CEO at threat intel­li­gence com­pa­ny KELA.

While it is not known how ele­vat­ed priv­i­leges on the sys­tem were obtained in order to infect the whole net­work, Carmiel says this “often hap­pens through the use of known vul­ner­a­bil­i­ties and fur­ther social engi­neer­ing”. 

He advis­es CIOs to imple­ment secu­ri­ty poli­cies to ensure all key stake­hold­ers and employ­ees do not down­load updates with­out ver­i­fy­ing their authen­tic­i­ty.

---