According to the popular security expert Kevin Beaumont, the ransomware has infected a portion of the infrastructure that hosts the company website (cosco-usa.com), phone and email systems, and WAN and VPN gateways.
Pierluigi Paganini
July 26, 2018
According to COSCO a “local network breakdown” disrupted some systems in the United States.
Media confirmed the incident was the result of a ransomware attack and quoted a company spokesman as the source.
“The China Ocean Shipping Co. Terminal at the Port of Long Beach was hit by a cyberattack on Tuesday, July 24.” states local media.
“A spokesman for the Shanghai-based company, which acknowledged the ransomware attack Tuesday, said that the company’s operations outside the United States were not affected.”
The shipping company quickly isolates the systems to avoid propagation to other regions and started an internal investigation, the firm confirmed that the incident did not affect operations of the fleet.
“Due to local network breakdown within our America regions, local email and network telephone cannot work properly at the moment. For safety precautions, we have shut down the connections with other regions for further investigations.” reads the security advisory published by COSCO.
“So far, all vessels of our company are operating normally, and our main business operation systems are stable. We are glad to inform you that we have taken effective measures and aside from the Americas region, the business operation within all other regions will be recovered very soon. The business operations in the Americas are still being carried out, and we are trying our best to make a full and quick recovery,”
The Journal of Commerce, citing COSCO Vice President Howard Finkel, reported communications between the carrier’s U.S. operations and its customers has been slowed due to the cyber attack. Digital communications were disrupted and the communications were going on via telephone.
Cosco responds to cyber attack on US operations #maritime #containers https://t.co/I7odBZJFUV pic.twitter.com/0LhtBGm4Bl
— JOC (@JOC_Updates) July 24, 2018
Port of Long Beach spokesman Lee Peterson confirmed the attack and added that it is monitoring the situation.
https://twitter.com/GossiTheDog/status/1022253685437546498
https://twitter.com/GossiTheDog/status/1022382677989699584
The good news is that the attack doesn’t appear severe as the NotPetya attack that hit shipping giant Maersk in August 2017.
According to the second quarter earnings report, there were expecting losses between $200 million and $300 million due to “significant business interruption” because the company was forced to temporarily halt critical systems infected with the ransomware.
Møller-Maersk chair Jim Hagemann Snabe during a speech at the World Economic Forum explained that the attack forced the IT staff to reinstall “4,000 new servers, 45,000 new PCs, and 2,500 applications,” practically “a complete infrastructure.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – COSCO, Ransomware)
[adrotate banner=”5″]
[adrotate banner=”13″]
