Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Vulnerability

3/21/2019
07:00 AM
Joe Stanganelli
Joe Stanganelli
Joe Stanganelli
50%
50%

Jackson County Still Recovering After Paying Ryuk Ransom

Radio silence after reports of a headline-snagging ransomware payment in Jackson County, Ga., presents a possible case study in the pros and cons of paying ransomware attackers.

Another headline-snagging ransomware infection in the public sector has rekindled debate over whether or not to pay cyber ransoms.

In the last couple of weeks of February, specially targeted ransomware silently made its way through government systems for Jackson County, Ga. -- impacting every agency countywide when the ransomware took effect on or about March 1.

The ransomware infection in question appears to be Ryuk ransomware -- a cryptographic variant of the nearly two-year-old Hermes ransomware. Ryuk is known to have been active since at least August 13, 2018 -- and is particularly dangerous because of the level of customization and dedication driving it. According to a US Department of Health and Human Services threat intelligence briefing issued in late August, each Ryuk infection is systematically tailored to deliberately targeted victims -- who are manually phished with malicious spam. From there, Ryuk encrypts "only crucial assets and [network] resources". (See Ryuk Ransomware Origin Remains a Mystery and Ryuk Ransomware Tied to Printing Press & Cloud Service Provider Attacks.)

"They really plotted their attacks before they hit us," County Manager Kevin Poe told the Athens Banner-Herald of Jackson County's Ryuk infection. "They totally crippled us."

To be sure, with this level of dedication devoted to individual payload delivery and gathering of both credentials and network maps, the Ryuk has been able to command high -- and increasingly higher -- ransoms. When first reported on in August 2018, Ryuk was known to command ransoms ranging from about $100,000 to well over $300,000 (estimates based on Bitcoin prices in August 2018). Jackson County was instructed to pay a ransom of $400,000 -- which would appear to represent growing confidence on the Ryuk crew's part (assuming, of course, that the consultants Jackson County reportedly hired to negotiate the ransom were on the up and up -- and didn't just charge Jackson County a premium after paying the ransomers a smaller amount out of pocket).

In any event, Jackson County paid the ransom.

Learning from Georgia history Jackson County's ransomware infection comes approximately one year after SamSam ransomware wreaked devastationthroughout city-government systems in Atlanta -- about 60 miles away. While the ransom demand in Atlanta's case was but a little more than $50,000, Atlanta -- unlike Jackson County -- apparently declined to pay their data's ransomers.

It is unclear whether Atlanta refused to pay the ransom or simply did not get the chance to do so. Regardless, Atlanta wound up sustaining several millions of dollars (possibly as much as $17 million) in recovery costs. Some of those millions were reportedly for forward-looking costs like upgrades and new security services, as opposed to remediating damage -- but upgrades in a time of crisis tend to cost more than when part of a planned upgrade schedule.

Furthermore, ponying up for new systems is often obligatory for IT departments when recovering from a ransomware infection regardless of whether or not the victim organization pays the ransom -- if only to ensure that no there are no traces of the malware left over after bringing everything back online.

Costs in Jackson CountyFor its part, Jackson County has had additional BC/DR costs on top of its ransom too, including the cost of cybersecurity consulting services. Still, if able to successfully use Ryuk's decryption tool, Jackson County's final ransomware bill doubtlessly stands to be much less steep than that of Georgia's capital.

Game theory dictates that ransomware victims should never pay ransom because a successful ransom incentivizes cybercriminals further -- while presenting no guarantee that a ransomee's data won't remain at risk. As is the case with many ransomware victims, however, for Jackson County, the issue was not one of principle but of immediate cost comparison.

"We had to make a determination on whether to pay," said Poe. "We could have literally been down months and months and spent as much or more money trying to get our system rebuilt."

It is unclear, however, how much good paying the ransom has done for Jackson County as of yet -- and what further costs, if any, may lie ahead. Although reports suggest that Jackson County paid the ransom sometime between March 6 and March 8, the last official word out of Jackson County on the matter comes from a March 12 post shared on the Jackson County Sheriff's Office Facebook page -- reporting that the Sheriff's Office was still experiencing an email outage. As of press time, there have been no updates since then from the Sheriff's Office, the county government's main page, or the Jackson County website.

Incident-response firm Coveware estimates that paid decryption on Ryuk ransoms is successful only 65% of the time.

Meanwhile, the Massachusetts Committee for Public Counsel Services (CPCS) -- the state agency that oversees Massachusetts attorneys' public-defense work -- was itself struck by Ryuk about two days before the Jackson County attack made itself known.

CPCS refused to pay the ransom because it has backups of its data.

Related posts:

—Joe Stanganelli is managing director at research and consulting firm Blackwood King LC. In addition to being an attorney and consultant, he has spent several years analyzing and writing about business and technology trends. Follow him on Twitter at @JoeStanganelli.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12505
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 ve...
CVE-2020-12506
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version ...
CVE-2020-4629
PUBLISHED: 2020-09-30
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.
CVE-2019-17098
PUBLISHED: 2020-09-30
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior version...
CVE-2020-15731
PUBLISHED: 2020-09-30
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448.