Texas Courts hit by ransomware, network disabled to limit spread

[CyberTech]

Content source

https://www.bleepingcomputer.com/news/security/texas-courts-hit-by-ransomware-network-disabled-to-limit-spread/

The Texas court system was hit by ransomware on Friday night, May 8th, which led to the branch network including websites and servers being disabled to block the malware from spreading to other systems.

"On Friday, May 8th, the Office of Court Administration (OCA), the information technology (IT) provider for the appellate courts and state judicial agencies within the Texas Judicial Branch, identified a serious security event in the branch network, which was later determined to be a ransomware attack," a statement published today on the site of the Texas Judicial Branch says.

"The attack began during the overnight hours and was first discovered in the early morning hours on Friday. The attack is unrelated to the courts’ migration to remote hearings amid the coronavirus pandemic."

 

[MacDefender]

This and the Pitney Bowes incident both make me wonder if from a network perspective it might start helping to have aggressive outbound filtering on clients. The encrypting part of ransomware is not as scary, in my opinion, because if you have a backup strategy you just lose a little bit of downtime to restore from backup.

The uploading all your data aspect of ransomware is definitely the new form of ransom and a lot of businesses/organizations have more to lose from public leaks than from losing their data or a few days of productivity.

It seems like we need either HIPS or a firewall level sanity check for clients that have been uploading more data than they usually do, and having that be an indicator of compromise.

This is kind of interesting because back in the late 90's early 2000's, firewalls all focused on outbound application control. ZoneAlarm led that pack and was quite infamous in all of the prompting dialogs every time a new application wanted to use the Internet. Over the course of the decades, it seems like almost every AV suite either completely dropped their outbound firewall or made a bunch of default-allow rules based off reputation or digital signature lookups. This might be the way it bites us now....

 

[CyberTech]

Updates

Texas courts slammed by ransomware attack

Officials say they will not bow to any blackmail or ransom demands.

www.zdnet.com