Held to ransom
More ransomware victims emerged this week, including the world's biggest meat processor, the New York subway, Fujifilm and Massachusetts' largest ferry service. The FBI blamed the Russia-based REvil group for the attack on JBS, which operates 150 food processing plants in 15 countries. President Biden will discuss the issue of cyber attacks with President Putin when they meet in Switzerland on June 16. The White House says the US is not taking any options off the table, in terms of how [it] may respond. In reality, the White House has already discussed the issue with Moscow and "delivered the message that responsible states do not harbor ransomware criminals".
As previous attacks on Colonial Pipeline and the health systems in the UK and Ireland have demonstrated, ransomware is a potentially deadly affair. REvil is believed to be based in Eastern Europe and Russia, and there is general agreement that it has no formal ties to the Russian government. But it's equally accepted that its activities could not take place without Moscow's tacit approval, and it's long been known that Russia has used criminal groups as a cover for its own operations. The US Department of Justice has decided to begin treating ransomware as terrorism, according to an official quoted by Reuters.
For ransomware victims, including some of our own clients, perhaps the biggest issue is not simply the loss of access to key networks, but the publication of information from them. Previously, a key defence against ransomware was the use of secure backups, combined with effective insurance. The ransomware organisations worked out that they could defeat this protection by not only encrypting a victim's data, but also threatening to publish the information unless they were paid. And that information includes credentials and network information that is likely to be sold regardless of whether any money changes hands. The situation has been compounded by a much tougher approach from insurers who are demanding higher premiums, tighter controls and, in some cases, refusing cover altogether.