Ransomware has struck a facility belonging to the U.S.
Coast Guard (USCG), affecting industrial control systems, security cameras, and
much more, according to the USCG, which didn’t reveal the name or location of
the affected base.
The ransomware, identified as “Ryuk,” is believed to have gained a foothold in USCG systems after an employee opened a phishing email and clicked on a link. It infected a number of critical systems, locking out users and cutting off access.
“Once the embedded malicious link in the email was
clicked by an employee, the ransomware allowed for a threat actor to access
significant enterprise Information Technology (I.T.) network files, and encrypt
them, preventing the facility’s access to critical files,” explains
the Coast Guard in the security bulletin.
“The virus further burrowed into the industrial control
systems that monitor and control cargo transfer and encrypted files critical to
process operations. The impacts to the facility included a disruption of the
entire corporate I.T. network (beyond the footprint of the facility),
disruption of camera and physical access control systems, and loss of critical
process control monitoring systems.”
It took more than 30 hours to get everything back on
track. The USCG explained that some protections in place mitigated effects of
the attack. Tools that helped them stay the effects of the Ryuk attack included
real-time monitoring traffic, up-to-date virus detection software, server
logging, network segmentation, and, most importantly, constant backing up of
all critical files and software.
Not surprisingly, this is not the first time this has happened.
Just six months ago, the Coast Guard issued an advisory regarding cybersecurity
attacks against shipboard networks. Homeland Security considers the Coast Guard
critical
infrastructure, and cyberattacks are taken seriously.