Source: securityboulevard.com – Author: Richi Jennings
Police, 911, courts and other city services staggering to recover.
The city of Dallas is still partially paralyzed from Monday’s ransomware attack. The city’s IT services are badly affected—including the police, 911 dispatch and the courts. The Royal ransomware group says it’s the perp.
Printers all over city offices are spewing out ransom demands. In today’s SB Blogwatch, we shot J.R. (ask your parents).
Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Fett For A King.
Royal, née Zeon, born of Conti
What’s the craic? J.D. Miles reports—“Ransomware attack hampering Dallas police”:
“Probably began with a phishing email”
The City of Dallas confirmed that a ransomware attack compromised a number of servers in its system, including the [police] department’s computer assisted dispatch system, called CAD, which directs police to emergencies and other calls. The issue forced 911 call takers to manually write down instructions for the responding officers.
…
The hackers, a group called Royal, claim that they encrypted the city’s critical data, and threatened to post sensitive information online. … Cyber experts believe the attack probably began with a phishing email that an unsuspecting employee opened.
Not only the po-po. Lawrence Abrams adds—“City of Dallas hit by Royal ransomware attack”:
“Remote access software”
The City’s court system canceled all jury trials and jury duty … as their IT systems are not operational.. … According to numerous sources, network printers on the City of Dallas’ network began printing out ransom notes … with the IT department warning employees to retain any printed notes.
…
The Royal ransomware operation is believed to be an offshoot of the Conti cybercrime syndicate, rising to prominence after Conti shut down its operations. … Towards the end of 2022, [Zeon] rebranded into Royal and quickly became one of the most active enterprise-targeting ransomware gangs.
…
They commonly use callback phishing attacks to gain initial access to corporate networks. … The emails contain phone numbers that the victim can contact [then] the threat actors use social engineering to convince the victim to install remote access software, allowing the threat actors access to the corporate network.
You gotta be kidding me? Turn to Carly Page—“Ransomware attack”:
“Remains unknown”
Royal … was recently the subject of a joint advisory released by CISA and the FBI [that] said that after gaining access to victims’ networks, typically via callback phishing—whereby hackers send emails claiming that the victim has or will be charged for a service and asks them to call a listed phone number for clarification—Royal hackers “disable antivirus software and exfiltrate large amounts of data” before deploying the ransomware and encrypting systems.
…
The full impact of the attack remains unknown. In a statement, the city said it was “actively working to isolate the ransomware to prevent its spread, to remove the ransomware from infected servers, and to restore any services currently impacted. The City is currently working to assess the complete impact.”
Time to implement your disaster-recovery plan. In the middle, it’s mr_mitm:
But before you restore backups (if you have any that weren’t encrypted) you may want to determine the exact time at which you were compromised, or else you’ll be restoring potentially tainted backups. Depending on how well you’re organized that alone will take weeks, especially considering that your logs may be encrypted as well. Sometimes you don’t even know how to contact everyone, because your comms are down, too.
Do they still have the death penalty in Texas? TrumpShaker ponders thuswise:
Ok, so, if the hackers are ever apprehended, what charges might be filed for, say, a death that occurs that might have been prevented if law enforcement were able to be dispatched to the location?
What else do we know about Royal? u/Mercy_Rule_34 alleges an allegation:
Same group hit a ton of north Texas medical practices last November, including most of the hospitals systems you know by name. All of it was kept under wraps because of the HIPAA accountability, meaning that as long as they paid the ransom, the PHI (personal health information) was never released and, thus, did not have to be reported to Medicare/other federal programs, which would potentially incur a massive, massive fine. Cheaper to pay the ransom.
…
Also notable: In early 2022 there were dozens of insurance companies providing coverage for cybersecurity for medical practices. Now there is one. Not a sustainable business model, obviously.
Why are scrotes such as Royal so successful? mr_00ff00 asks “the big question”:
The big question gets raised again, how do we get the non-tech savvy to be safe from cyber threats? Banks and tech companies have high security because they know what they are dealing with, pipelines/schools/hospitals/emergency services continue to be easy targets and things we need to pay money quickly for to get back.
…
It’s way easier to find a school or government agency that keeps passwords in plain text in code comments or emails than it would be at Meta. … You can hold medical records and pipelines hostage and get just as much money as holding Google info hostage.
It’s so hard to combat phishing. But dmay34 thinks they have the solution:
I understand that phishing emails are things that are stupid effective, but I’ll never see one of these ransomware attack headlines without first thinking “Stop looking at porn on work computers!”
Meanwhile, u/Tired_Sysop is tired:
Not surprising. The city of Dallas websites I use to pay my water bill and property taxes look like they were built with MS Frontpage 95. They are so bad I’m surprised they don’t require you to install a Java 7 client to interact with their website.
And Finally:
You have been reading SB Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weirdest websites … so you don’t have to. Hate mail may be directed to @RiCHi or [email protected]. Ask your doctor before reading. Your mileage may vary. Past performance is no guarantee of future results. Do not stare into laser with remaining eye. E&OE. 30.
Image sauce: JobsForFelonsHub.com (cc:by; leveled and cropped)
Recent Articles By Author
Original Post URL: https://securityboulevard.com/2023/05/dallas-royal-ransomware-richixbw/
Category & Tags: Analytics & Intelligence,Application Security,Cloud Security,Cyberlaw,Cybersecurity,Data Security,DevOps,Editorial Calendar,Endpoint,Featured,Governance, Risk & Compliance,Humor,Identity & Access,Identity and Access Management,Incident Response,Malware,Mobile Security,Most Read This Week,Network Security,News,Popular Post,Ransomware,Security Awareness,Security Boulevard (Original),Security Operations,Social Engineering,Spotlight,Threat Intelligence,Threats & Breaches,Vulnerabilities,Zero-Trust,Conti,Dallas,Dallas Police,Royal Ransomware,SB Blogwatch,Zeon Ransomware – Analytics & Intelligence,Application Security,Cloud Security,Cyberlaw,Cybersecurity,Data Security,DevOps,Editorial Calendar,Endpoint,Featured,Governance, Risk & Compliance,Humor,Identity & Access,Identity and Access Management,Incident Response,Malware,Mobile Security,Most Read This Week,Network Security,News,Popular Post,Ransomware,Security Awareness,Security Boulevard (Original),Security Operations,Social Engineering,Spotlight,Threat Intelligence,Threats & Breaches,Vulnerabilities,Zero-Trust,Conti,Dallas,Dallas Police,Royal Ransomware,SB Blogwatch,Zeon Ransomware
