Pierluigi Paganini September 05, 2019

Another US city was the victim of a ransomware attack, this time crooks hit the city of New Bedford, Massachusetts, asking for $5.3 Million Ransom, but…

The systems of New Bedford, Massachusetts, were infected with ransomware and crooks asked for a $5.3 million ransom to decrypt data.

The ransom was too high for the city that attempted negotiation and offered $400, 000, but crooks refused it. Then the city opted out to restore from backups.

The city refused to pay the ransom because it didn’t have the funds and considering that the request made by the crooks was the largest payment ever made.

The attack took place on Friday, July 5, but at the time of writing technical details of the infection haven’t been revealed.

Mayor Jon Mitchell disclosed the ransomware attack and revealed that 4% of the City’s computers (158 workstations) were impacted.

Mitchell added that the malware involved in the attack is a variant of the Ryuk ransomware.

“The MIS staff disconnected the City’s computer servers and shut down systems to prevent the virus from gaining a larger foothold across the City’s network.” states the New Bedford.

“The specific virus was a variant of the RYUK virus, a ransomware virus whose purpose is the financial extortion of a computer network’s operator – in this case, the City of New Bedford. RYUK encrypts, or renders inaccessible, the data stored on computer servers and workstations. In order to potentially unlock the encrypted data, the operator must then make a payment to acquire a decryption key from the attacker to access its data. RYUK has been implicated in attacks on government, education, and private sector networks around the nation and the world.”“

The threat was quickly contained by the Management Information Systems (MIS) staff that isolated the infected systems from the network.

“While the attack was still underway, the city, through its consultants, reached out to the attacker, which had provided an email address,” added Mayor Mitchell.

“The attacker responded with a ransom demand specifically that it would provide a decryption key to unlock the encrypted files in return for a Bitcoin payment equal to $5.3 million,”

The good news is that the MIS Department of New Bedford City has completely recovered the City’s server network and replaced all of the infected computer workstations. The Ryuk ransomware infected other cities in the past.

In April, systems at Stuart City were infected by the same Ryuk ransomware, in early March, Jackson County, Georgia, was hit by the same ransomware that paralyzed the government activity until officials decided to pay a $400,000 ransom to decrypt the files.

Pierluigi Paganini

(SecurityAffairs – New Bedford city, Ryuk ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]