The hackers who launched simultaneous ransomware attacks on Texas State government municipalities have reportedly demanded a $2.5 million payout to unlock the infected systems.
As more details trickle out about the case which was previously spoken about with great restriction from investigating authorities, it has been revealed that the number of affected government entities has dropped from 23 to 22.
Responders have identified and engaged all of those affected and are working to regain control and access to the systems. No ransoms have been paid as of yet, according to Elliott Sprehe, a DIR spokesperson who spoke to NPR.
The Texas State Department of Information Resources (DIR), a government information portal providing technology advice to state authorities, noted that "more than 25% of impacted entities have transitioned from response and assessment to remediation and recovery, with a number of entities back to operations as usual".
Most of the affected departments were based in rural locations and only two of the 22 affected departments have released statements regarding their respective attacks.
"This attack has impacted normal City business and financial operations and services, however, the City has implemented its continuity of operation plans and the City continues to provide basic and emergency services (Police, Fire, 9-1-1, Animal Control, Water, Wastewater and Solid Waste Collection)," said officials from the City of Borger.
"Currently, Vital Statistics (birth and death certificates) remains offline, and the City is unable to take utility or other payments.
"Based on the current state of the forensic investigation, it appears that no customer credit card or other personal information on the City of Borger's systems have been compromised in this attack. No further information about the origins of the attack will be released until the completion of the investigation."
The other city to have spoken out about the attack is Keene, the mayor of which said the hacker used island hopping, an increasingly popular method of cyber attack to breach the city's IT systems.
"They got into our software provider, the guys who run our IT systems," said Keene Mayor Gary Heinrich to NPR. "A lot of folks in Texas use providers to do that, because we don't have a staff big enough to have IT in house."
Heinrich added that many other targeted municipalities also use the same managed service provider (MSP).
"US government bodies have recently been a major target for ransomware attackers as they have been seeing huge payouts from their attacks, with numerous governments giving into attacker demands and reportedly paying ransoms," said Robert Ramsden-Board, VP of EMEA at Securonix.
"It is therefore not surprising the attackers in this instance are demanding such a huge amount of money - if it worked with previous government agencies, why should it work again?
"However, it generally is never recommended to pay ransom demands as this only fuels the industry. Instead, the best defence against ransomware is a comprehensive security program that protects against known threats and malicious intent or behaviour."
Heinrich was the individual to disclose the $2.5 million ransom demand and said that everything that's done at City Hall is impacted.
19/08/2019: Texas government sites hit by coordinated ransomware attack
A coordinated wave of ransomware attacks successfully struck 23 government entities simultaneously in Texas on Friday morning.
All 23 sites, which have so far been kept anonymous by the State of Texas, reported difficulties accessing the Department of Information Resources (DIR), a government information portal providing technology advice to state authorities.
So far it's unclear precisely what damage has been caused by the attacks, however, investigators have said they believe that based on its timing it's likely it came from a single source.
All government entities that have been affected or could potentially be affected have been notified, although it has been confirmed that Texas State systems and networks remain operational.
The DIR, FBI, FEMA, Texas A&M University, the Texas military department and a host of others are being deployed to lend assistance to the affected entities.
"Investigations into the origin of this attack are ongoing; however, response and recovery are the priority at this time," said the DIR.
"In addition to the regular 'hacker's benefits' of gaining access to customer data, an attacker who penetrates a city's system may get access to sensitive residents information," said Liron Barak, CEO at BitDam. "Depending on the IT structure of the targeted local government, hackers can have an impact on multiple systems, beyond just customer information databases.
"From an attacker's perspective, the potential in hacking a city is much higher than the potential in hacking a commercial organisation," she added. "In addition, local governments tend to communicate with a wide variety of businesses and individuals, with many of them being one time contacts. This makes them more vulnerable to attacks, as their employees don't know most of the contacts with whom they communicate in person."
Although 23 is a significant number, it's actually a comparatively small number in terms of the total 5,343 government entities there are in Texas. At this time, it's unclear how many were targeted compared to how many were successfully infected.
The type of ransomware has been identified as '.JSE', according to a local source speaking to ZDNet.
Operating differently to most other ransomwares, .JSE doesn't leave a ransom note behind after it encrypts files and adds the .JSE extension to the end.
It's the latest in a string of ransomware attacks on smaller US targets in recent months. In May, the city of Baltimore was hit by ransomware that crippled its public services, including those that control tax payments, water bills and parking tickets. This was followed a month later by attacks on two Floridian towns, both within the same week.
"Not only have ransomware attacks been growing, but the amounts they have been demanding has been getting higher, and there has been more specific targeting of victims," said Javvad Malik, security awareness advocate at KnowBe4.
"Recently Florida city agreed to pay $600,000 in ransomware after being affected," he added. "So this co-ordinated attack against Texas may be as a result of seeing how cities or city departments are potentially willing to pay a ransom."
