US Congress Staff Bans Yahoo Mail After Service Fails to Flag Ransomware Attacks

[Alkajak]

Content source

http://news.softpedia.com/news/us-congress-staff-bans-yahoo-mail-after-service-fails-to-flag-ransomware-attacks-503954.shtml

Systems administrators for the House of Representatives have temporarily banned the usage of Yahoo's Mail service after saying the service has failed to detect mass phishing attacks spreading ransomware.

According to an internal email sent by the Technology Service Desk to the house staff on April 30, the system administrators revealed an increase of ransomware attacks on the house's IT network.

An anonymous source told Gizmodo that a ransomware infection affected at least one computer. The source said the IT staff managed to isolate it before allowing it to spread.

Staff claims that attackers sent phishing emails claiming to be from known senders. Attackers used both Yahoo Mail and Gmail services, but predominantly Yahoo.

The emails contained malicious JavaScript files inside ZIP file attachments, a known method of infection, used by many ransomware variants and other types of malware.

The house staff said the Yahoo Mail service will remain blocked until further notice. They also said mitigations to prevent future attacks are also being put into place.

Prior to affecting the House of Representatives, ransomware has also made victims among hospitals, water supply centers, churches, police centers, courthouses, schools, and various other institutions. In most cases, affected organizations had to pay the ransom to unlock the affected computers.

The most famous ransomware using malicious JavaScript files packed inside ZIP files is named Locky. The ransomware is currently undecryptable.

Below is the email, obtained by Gizmodo.

From: Technology Service Desk
Sent: Saturday, April 30, 2016 11:53 AM
To: All House Staff
Subject: Increase in Ransomware at The House
Importance: High

In the past 48 hours, the House Information Security Office has seen an increase of attacks on the House Network using third party, web-based mail applications such as YahooMail, Gmail, etc. The attacks are focused on putting “ransomware” on users’ computers. When a user clicks on the link in the attack e-mail, the malware encrypts all files on that computer, including shared files, making them unusable until a “ransom” is paid. The recent attacks have focused on using .js files attached as zip files to e-mail that appear to come from known senders. The primary focus appears to be through YahooMail at this time.

The House Information Security Office is taking a number of steps to address this specific attack. As part of that effort, we will be blocking access to YahooMail on the House Network until further notice. We are making every effort to put other mitigating protections in place so that we can restore full access as soon as possible.

Please do your part to help us address this recent attack and protect the House Network going forward by following proper cyber practices at all times. Phishing e-mails can look very legitimate and appear to come from known senders. Be very careful about clicking on attachments or links in e-mails, particularly when you are using non-House e-mail systems.

If you have any questions, please contact the CAO Technology Service Desk (REDACTED) at REDACTED or REDACTED.

Full Article: US Congress Staff Bans Yahoo Mail After Service Fails to Flag Ransomware Attacks