Blog
The Future of Ransomware: JBS Ransomware 2021 Explained
No Comments
Today, we live in a world where there is nothing, and I mean nothing, off the limits for cyberattacks and particularly ransomware attacks. Our hospitals, our universities, oil pipelines, and now even our meat is under cyberattack. The cyberattack that flattened the IT operations at JBS Foods over the weekend turns out was a ransomware strike. If you didn’t know, JBS is a Brazilian-based global provider of beef, chicken, and pork with 245,000 employees operating on several continents. On Friday, the FBI has confirmed that REvil Group is behind the attack.
Ransomware Attacks on the rise
In the aftermath of the Quanta and Apple ransomware fiasco, DarkSide publicly announced that they were shutting down operations and it appeared that trouble had made its way back to the cybercrime underworld. Since then, the ransomware seems to have bounced back by targeting yet another component in our critical infrastructure and that is our food supply chain.
In the case of JBS, the attackers targeted their servers located in North America and Australia. JBS had backups of their data and were able to restore their operations so they kinda lucked out. They have not disclosed whether they paid a ransom or not, I guess something we will find out over the next few weeks. Now, let’s talk about where we go from here.
Ransomware: Where do we go from here
It is clear at this point that ransomware has become more pervasive and frequent than ever and even the most sophisticated IT vendors such as Quanta and Apple are no longer out of the reach, so what does that mean for the companies in sectors such as healthcare, education, food, oil, and gas? These are companies who do not even see themselves as tech companies so if you are a ransomware attacker, you just see a virtually unlimited surface out there. More and more companies are now buying insurance against ransomware and that is institutionalizing ransomware payouts and feeding up the ransomware-as-a-service business model.
Now, whether we like it or not, there are countries out there that turn a blind eye to cyber attackers as long as the victims are located outside the country or the region. I think before it’s too late, we need to build an international coalition to deal with such countries that harbor ransom actors. So, what else can we do? Remember. Not all ransomware starts with a phishing attack. In the case of the colonial pipeline attack, we now know that it started with a compromised password. DarkSide hackers gained entry into the network using an employee’s VPN account. The employee had used the same password on another account that was previously hacked and published on the dark web. However, it is still not clear how hackers corroborated the leaked password with the correct username to successfully VPN into the colonial network and exfiltrate 100 gigabytes of data. No matter how it happened, colonial IT folks didn’t take the time to implement two-factor authentication.
Ransomware and US legislations
Now, this goes back to what we discussed before, given that most of our critical infrastructure is run by private companies, we need a cybersecurity regulatory framework for private businesses who plan, deploy, maintain or troubleshoot critical infrastructure. Back in 2012, there was a bill in the senate to close this very gap which required private companies to adhere to cybersecurity standards, as stupid as it sounds, it died on the Senate floor because of the Republican filibuster. And here we are today in 2021, 9 years later, inundated by the barrage of cybersecurity attacks. Thanks, Mitch. Anyhow, I have put a link in the description, in case if you are interested in reading over 200 pages long Cybersecurity Act of 2012. So, again, where do we go from here, like what can we expect in the coming weeks and months.
Well, you don’t need any guesses for the future of Ransomware. The REvil group spokesperson was interviewed by the Russian OSINT YouTube channel where he shared his thoughts about future targets, alliances, and revenue. Number one. No US legislation would deter future attacks. He is referring to a proposal to ban ransomware payments recently proposed by the US Ransomware Task Force. Number two. REvil is not afraid of being labeled a terrorist organization. And finally, the spokesperson claimed that REvil has now lifted restrictions on attacking the US targets, i.e., more ransomware attacks are on the way for US companies and infrastructure.
