Attacks/Breaches

3/6/2018
12:45 PM
50%
50%

Second Ransomware Round Hits Colorado DOT

A variant of SamSam sends CDOT employees back to pen and paper with two attack waves in two weeks.

Getting hit by ransomware is expensive and embarrassing. Getting hit twice in a two-week period makes it much worse. That's the situation in which the Colorado Department of Transportation (CDOT) finds itself after a second wave of SamSam ransomware hit while the department was still in the process of cleaning up from the first attack.

In the first attack, over 2,000 computers running Windows and McAfee security software were taken offline after their files were encrypted. Approximately 20% of those systems had been brought back into service when a variation of the original ransomware struck in a second wave of attacks. All affected computers were once again taken offline as employees of the department reverted to pen and paper to complete routine tasks.

In an interview with the Denver Post, Brandi Simmons, a spokeswoman for the state's Office of Information Technology said, "The variant of SamSam ransomware just keeps changing. The tools we have in place didn't work. It's ahead of our tools."

Dozens of staff members from Colorado's Office of Information Technology, the Colorado National Guard, and the FBI are working to get the systems back online. There is no current timeline for having all systems restored to service.

Read more here and here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.