The City of New Bedford, in Massachusetts, has found a way to deal with ransomware without paying: shoring up defenses, restoring from backups, and rebuilding systems.
The attack on the American city's systems was identified on July 5, after employees noticed unusual network activity upon returning from the July 4th holiday, Mayor Jon Mitchell explained in a press conference on Wednesday. "We haven't seen any interruption in municipal services at all," said Mitchell. The city's Management Information Systems (MIS) staff identified the presence of the file-scrambling RYUK nasty, a sophisticated form of ransomware, and through prompt action managed to limit its impact. Supposedly named for a character in the manga series Death Note, RYUK can find and encrypt network drives, and delete volume snapshots to prevent the use of Windows System Restore in the absence of external backups. The malware locks up data on target systems and presents a demand for payment in Bitcoin as a condition for receiving a decryption key that, perhaps, will unlock the captured data.
Those behind the infection demanded $5.3m in Bitcoin to release New Bedford's files, according to Mitchell, who said ransomware outbreaks against government, education and private sector organizations have become more common and more costly – at least in terms of demand, though not necessarily in terms of payment. In Texas last month, 23 towns were hit by a coordinated ransomware attack. More than half are said to be back to business as usual and Texas officials insist they're unaware of any ransom being paid. Unwilling to pay $5.3m, Mitchel said he made a counter-offer of $400,000, based on cyber-insurance proceeds available to the city. The cyber-crim declined and the city continued negotiating, buying the IT staff the time needed to bolster defenses and restore files from backups, to the extent possible.
The sound is pretty poor. Using the subtitle helps.