[BreachExchange] New Bedford city infected with Ryuk ransomware, but did not pay $5.3M ransom

[Destry Winant]

https://securityaffairs.co/wordpress/90848/cyber-crime/new-bedford-ryuk-ransomware.html

Another US city was the victim of a ransomware attack, this time
crooks hit the city of New Bedford, Massachusetts, asking for $5.3
Million Ransom, but…

The systems of New Bedford, Massachusetts, were infected with
ransomware and crooks asked for a $5.3 million ransom to decrypt data.

The ransom was too high for the city that attempted negotiation and
offered $400, 000, but crooks refused it. Then the city opted out to
restore from backups.

The city refused to pay the ransom because it didn’t have the funds
and considering that the request made by the crooks was the largest
payment ever made.

The attack took place on Friday, July 5, but at the time of writing
technical details of the infection haven’t been revealed.

Mayor Jon Mitchell disclosed the ransomware attack and revealed that
4% of the City’s computers (158 workstations) were impacted.

Mitchell added that the malware involved in the attack is a variant of
the Ryuk ransomware.

“The MIS staff disconnected the City’s computer servers and shut down
systems to prevent the virus from gaining a larger foothold across the
City’s network.” states the New Bedford.

“The specific virus was a variant of the RYUK virus, a ransomware
virus whose purpose is the financial extortion of a computer network’s
operator – in this case, the City of New Bedford. RYUK encrypts, or
renders inaccessible, the data stored on computer servers and
workstations. In order to potentially unlock the encrypted data, the
operator must then make a payment to acquire a decryption key from the
attacker to access its data. RYUK has been implicated in attacks on
government, education, and private sector networks around the nation
and the world.”

The threat was quickly contained by the Management Information Systems
(MIS) staff that isolated the infected systems from the network.

“While the attack was still underway, the city, through its
consultants, reached out to the attacker, which had provided an email
address,” added Mayor Mitchell.

“The attacker responded with a ransom demand specifically that it
would provide a decryption key to unlock the encrypted files in return
for a Bitcoin payment equal to $5.3 million,”

The good news is that the MIS Department of New Bedford City has
completely recovered the City’s server network and replaced all of the
infected computer workstations. The Ryuk ransomware infected other
cities in the past.

In April, systems at Stuart City were infected by the same Ryuk
ransomware, in early March, Jackson County, Georgia, was hit by the
same ransomware that paralyzed the government activity until officials
decided to pay a $400,000 ransom to decrypt the files.