LOCKBIT is not a new player in the cybercrime world. Known for its sophisticated tactics, this group specializes in ransomware attacks. Their modus operandi involves infiltrating systems, encrypting data, and demanding hefty ransoms in exchange for decryption keys. In the case of Jacksonville Beach, LOCKBIT targeted the city’s information system, potentially compromising sensitive data.
On February 12, LOCKBIT escalated the situation by listing local residents’ personal information on their website. Social security numbers, addresses, and other private details were suddenly exposed. Panic ensued as citizens grappled with the realization that their identities were at risk. The city’s response was swift: they refused to pay the ransom demanded by LOCKBIT, adhering to Florida’s laws prohibiting such payments.
Fortunately, an international police operation intervened, dismantling the criminal empire. LOCKBIT’s reign of terror was cut short, but the damage had already been done. The question remained: where did the stolen data end up? Forensic experts began their painstaking work, attempting to trace the digital breadcrumbs left by the cybergang. Months of investigation lay ahead, and even then, a complete picture might never emerge.
The fallout from the Jacksonville Beach incident is multifaceted. First and foremost, citizens face the uncertainty of whether their personal information is circulating on the dark web. LOCKBIT’s exposure of social security numbers and addresses could have severe consequences, from identity theft to financial fraud. The hotline set up by the city (844-709-0703) aims to address citizens’ concerns, but the road ahead remains murky.
As we reflect on this cybertheft, several crucial lessons emerge:
Vigilance is Key: Cyber threats are real and ever-evolving. Citizens must remain vigilant, practicing good cybersecurity hygiene. Regularly update passwords, avoid suspicious emails, and be cautious when sharing personal information online.
Backup Your Data: Ransomware attacks can cripple organizations and individuals. Regularly back up your data to secure locations. If your files are encrypted, having backups ensures you don’t have to pay a ransom to regain access.
No Ransom Payments: Jacksonville Beach’s refusal to pay the ransom was commendable. By adhering to this stance, they not only followed the law but also sent a message to cybercriminals that their tactics won’t work.
Collaboration Matters: International cooperation played a crucial role in dismantling LOCKBIT. Cybercrime knows no borders, and joint efforts are essential to combating it effectively.
BHI Energy, a division of Westinghouse Electric Company, provides specialized engineering services and workforce solutions to support government and private-run power generation facilities, including nuclear, wind, solar, and fossil fuel units and transmission and distribution lines for energy.
The company has sent a data breach notification to affected individuals, where it has provided details on how the ransomware gang (Akira) breached its network on May 30, 2023.
The Akira threat actor initiated the attack by utilizing the compromised VPN credentials of a third-party contractor to gain entry to BGI Energy's internal network.
"Using that third-party contractor's account, the TA (threat actor) reached the internal BHI network through a VPN connection[…]In the week following initial access, the TA used the same compromised account to perform reconnaissance of the internal network," the breach notification read.
On June 16, 2023, the Akira operators checked the network again to see how much data had been taken. The threat actors took 690 GB of data, including the Windows Active Directory database of BHI, in 767k files between June 20 and June 29.
After obtaining the data from BHI's network, the threat actors deployed the Akira ransomware on every targeted system to encrypt files on June 29, 2023. At this point, the IT staff at BHI were aware that the business had been compromised.
The data obtained by the ransomware group involved the personal information of the victim. In an investigation held on September 1, 2023, it was revealed that the stolen data included:
The firm claims that it was able to restore its systems without having to pay a ransom because it was able to retrieve data from a cloud backup solution that was unaffected by the ransomware attack.
Moreover, by implementing multi-factor authentication for VPN access, resetting all passwords globally, expanding the deployment of EDR and AV technologies to cover every area of its environment, and decommissioning legacy systems, BHI strengthened its security protocols even further.
Reportedly, the hackers claim to have stolen the company’s source code for D-View network management software. The company has also compromised millions of personal data entries of its customers and employees, along with that of its CEO.
The compromised data includes the victim’s names, addresses, emails, phone numbers, account registration dates, and the users' last sign-in dates.
A thread participant noted that the data appeared to be very old after releasing samples of 45 stolen records with timestamps between 2012 and 2013.
The attacker stated, "I have breached the internal network of D-Link in Taiwan, I have 3 million lines of customer information, as well as source code to D-View extracted from system[…]This does include the information of MANY government officials in Taiwan, as well as the CEOs and employees of the company."
The stolen data has been available on the illicit forums since October 1st, with the hackers demanding a ransom of $500 for the stolen client data and purported D-View source code.
According to D-Link, the security lapse happened as a result of a worker falling for a phishing scam, which gave the attacker access to the company's network.
After realizing what had transpired, the company quickly shut down possibly impacted systems in reaction to the hack, and all user accounts used for the investigation — except two — were disabled.
D-Link further noted that the hackers have also gained access to one of its product registration systems when it was running on an old D-View 6 system, which reached its end of life in 2015, in what D-Link described as a "test lab environment,"
However, D-Link did not make it clear as to why the end-of-life server was still running on the company’s network and was subsequently exposed to the Internet for the past seven years.
D-Link confirmed that the compromised system only had about 700 records, with information on accounts that had been open for at least seven years, in contrast to the attacker's assertion that millions of users' data had been stolen.
"Based on the investigations, however, it only contained approximately 700 outdated and fragmented records that had been inactive for at least seven years," D-Link stated. "These records originated from a product registration system that reached its end of life in 2015. Furthermore, the majority of the data consisted of low-sensitivity and semi-public information."
D-Link believes the threat actor intentionally altered the timestamps of recent logins in order to give the impression that more recent data theft occurred. The majority of the business's current clients aren't anticipated to be affected by this issue, the company added.
Apparently, the ransomware gang stole more than 500,000 Social Security numbers and copies of the company’s employees’ driving licenses and passports. Also, other legal and financial documents are said to be compromised.
Prospect Medical Holdings—currently operating 16 hospitals spread across four U.S. states—confirms that the ransomware attack was launched earlier this month, because of which they have been facing issues in their online operations.
Moreover, several elective surgeries, outpatient appointments, blood drives and other services are put to hold owing to the attack.
According to a Prospect spokesperson, the company was unable to comment on the suspected data leak due to "the sensitivity of the incident and law enforcement involvement."
"Prospect Medical continues to work around-the-clock to recover critical systems and restore their integrity[…]We are making significant progress. Some operational systems have been fully restored and we are in the process of bringing others online," the spokesperson said.
Rhysida confirmed Prospect as one of its victims on its dark web site this Thursday, stating that it had taken 1.3 terabytes of SQL data and 1 terabyte of "unique" files.
Certainly, if the ransom demands are not fulfilled, the ransomware group has threatened the firm to expose their victims’ names to their site.
Rhysida, in a listing, says that it will auction off "more than 500,000 SNNs, passports of their clients and employees, driver's licenses, patient files (profile, medical history), financial and legal documents!!!"
The auction apparently ends in nine days, with 50 Bitcoins as ransom, per the listing.
Rhysida first came to light in May, however the government officials and cybersecurity professionals claim to have already known about the group, following instances of the group targeting critical infrastructure organizations in recent months.
Also, the Department of Health and Human Services (HHS) published an advisory in regards to the group, since Rhysida’s prime targets involved organizations in the health and public health sector. They further noted that Rhysida’s victims also involved firms in the education and manufacturing sectors.
HHS has advised organizations to patch known security flaws present in their systems and install data back-ups in case they are taken offline. Moreover, they recommended phishing awareness training programs for employees.
British Airways (BA), Boots, and BBC have recently been investigating an alleged cyber incident. The attack, apparently carried out by a Russia-based criminal gang, included the theft of the personal data of the companies' employees.
BA confirmed the attack, noting that the hackers targeted software named MOVEit used by Zellis, a payroll provider.
“We have been informed that we are one of the companies impacted by Zellis’s cybersecurity incident, which occurred via one of their third-party suppliers called MOVEit,” said a British Airways spokesperson.
The affected BA employees were informed about the situation through an email, which read that the compromised data included their names, addresses, national insurance numbers, and banking details, according to The Telegraph which initially reported about the incident. BA further added that the attack has prominently affected the staff who were paid via BA payroll in the UK and Ireland.
Another company affected by the attack, Boots, says that “some of our team members’ personal details” were compromised. The Telegraph reported that the staff members were informed about the attacks, with the stolen data involving their names, surnames, employee numbers, dates of birth, email addresses, the first lines of home addresses, and national insurance numbers.
While a BBC spokesperson has confirmed the attacks, the corporations decline that the breach involves any of its staff’s bank details.
“We are aware of a data breach at our third-party supplier, Zellis, and are working closely with them as they urgently investigate the extent of the breach. We take data security extremely seriously and are following the established reporting procedures,” the spokesperson said.
Microsoft threat intelligence, in a tweet on Sunday, claimed the attacks on MOVEit were carried out by a threat group called Lace Tempest. The group is popular among threat intelligence firms for their ransomware operations and running “extortion sites” carrying data obtained in attacks using a ransomware strain called Clop.
Microsoft says “The threat actor has used similar vulnerabilities in the past to steal data and extort victims.”
According to Rafe Pilling, director of Secureworks, a US-based security firm, the attack was probably carried out by an affiliate of the cybercriminal gang behind the Clop ransomware, as well as the connected website alluded to by Microsoft where stolen data is advertised. He adds that a Russian-speaking cybercrime organization was responsible for Clop.
Pilling forewarns the victims, asserting they might be contacted by the hackers in the near future, demanding ransom in return for the stolen data. “Victims will be contacted and if they refuse they will probably be listed and published on the Clop site,” he said. Furthermore, MOVEit spokesperson recently confirmed that they have “corrected” the vulnerability exploited by the threat actors.
“We are continuing to work with industry-leading cybersecurity experts to investigate the issue and ensure we take all appropriate response measures,” they added.