The Threat of Malware on the United States Government

The Threat of Malware on the United States Government

Threats to government agencies, including local, state, and even federal entities have been on the rise in recent years. This year, with the SolarWinds hack, we saw one of the largest and still largely unknown threats that targeted government and commercial entities that may have shed the most light on the ever-growing threats against government agencies.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Taken from a CISA alert regarding Ransomware targeting the public health sector, here are some vital takeaways that government organizations should be using:

• Patch operating systems, software, and firmware as soon as manufacturers release updates.
• Regularly change passwords to network systems and accounts and avoid reusing passwords for different accounts.
• Use multi-factor authentication where possible.
• Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
• Implement application and remote access allow listing to only allow systems to execute programs known and permitted by the established security policy.
• Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
• Audit logs to ensure new accounts are legitimate.
• Implement network segmentation. Sensitive data should not reside on the same server and network segment as the email environment.
• Set antivirus and anti-malware solutions to automatically update; conduct regular scans.
• Regularly back up data, air gap, and password protect backup copies offline.
• Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, secure location.
• Focus on awareness and training. Because end users are targeted, make employees and stakeholders aware of the threats—such as ransomware and phishing scams—and how they are delivered. Additionally, provide users training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
• Ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack. This will ensure that the proper established mitigation strategy can be employed quickly and efficiently.

Details

Along with the massive SolarWinds hack, there has been an increase in ransomware attacks against many local and state governments that have crippled key infrastructure for weeks and months, in a time when people needed the most assistance from the government. While in some cases these organizations may be targeted due to potential lack of security budget meaning they would be easier to compromise, other cases may be for political motivations. Oftentimes however, these could all be victims of opportunity, especially in cases when ransomware is involved. This method allows attackers to “spray and pray” anyone and everyone regardless of size or entity in order to force victims to pay a ransom or end up shutting down critical public services.

ZeroFOX has observed the following ransomware groups targeting government entities as of January 1, 2021:

Figure 1: Active Ransomware Groups and the number of government victims per group

One potential reason for the increase in attacks on government entities could be due to the lack of security and/or funding for the services being attacked. With limited budgets, local and state government agencies may not be able to perform all the functions of a well-rounded security program, or not have proper tooling or personnel in place to prevent these sorts of attacks. Knowing this, along with the fact that the public requires certain services, which if taken down, would increase demand by the public to restore them as quickly as possible, attackers would capitalize on this and distribute ransomware to the victims forcing them to pay. Unlike commercial organizations, the general population doesn’t rely on these services to maintain certain aspects of their lives, so commercial organizations have more flexibility when it comes to paying the ransom.

The impact of malware/ransomware on organizations has varied, with some major instances including the following impact:

• In 2019, the city of Baltimore, MD was the victim of the RobbinHood ransomware variant, which impacted all servers (with the exception of essential services). The real estate market in Baltimore was also impacted due to property transfers not being completed until the systems were restored. This was a multi-month effort to restore and cost upwards of $18 million dollars.

Figure 2: Twitter posting for Robbinhood ransomware targeting Baltimore city

• In 2019, Jackson County, GA was targeted with Ryuk ransomware and paid $400,000 to restore access to their files, after crippling key infrastructure including emergency services.
• In 2019, Lake City, FL was targeted with Ryuk ransomware which impacted phones, email, and online utility payment programs forcing the city to pay $460,000
• In 2018, the city of Atlanta, GA was the victim of a ransomware attack (the ransomware variant was SamSam) and potentially impacted up to 6 million people. Costs were upward of $9.5 million to recover from this attack.

Stories like the ones above would likely only motivate potential attackers to target government organizations due to the hefty payouts and urgency in which they would need to pay. With malware basically providing a suite of tools to attackers, like TrickBot and BazarLoader, the attackers are better equipped to rapidly deploy and compromise entities by dropping ransomware on their machines.

Conclusion

Ransomware has played a huge role in the prompting of new cybersecurity policy and has definitely brought this immense problem to light, with many organizations coming together to tackle this problem. With easier tools to use, a weakened cybersecurity program and funding, and no lack of targets, the risk is a lot higher that many government entities will be attacked, and potentially compromised.

With more pressure from government officials and the FBI to not pay the ransom, this may force ransomware operators to make it more affordable and likely to pay, or take other actions to force payment, like, leaking stolen data until the ransom is paid.