US Coast Guard Hit With Ryuk Ransomware

Ryuk ransomware has struck a facility belonging to the U.S. Coast Guard (USCG), affecting industrial control systems, security cameras and more, according to the USCG.

The USCG didn’t reveal the name or location of the affected base, but says it affected a "Maritime Transportation Security Act (MTSA) regulated facility." The ransomware gained a foothold in USCG systems after an employee opened a phishing email and clicked on a link. “Once the embedded malicious link in the email was clicked by an employee, the ransomware allowed for a threat actor to access significant enterprise Information Technology (I.T.) network files, and encrypt them, preventing the facility’s access to critical files,” explains the Coast Guard.

“The virus further burrowed into the industrial control systems that monitor and control cargo transfer and encrypted files critical to process operations. The impacts to the facility included a disruption of the entire corporate I.T. network (beyond the footprint of the facility), disruption of camera and physical access control systems, and loss of critical process control monitoring systems,” says the USCG.

USCG notes that it took more than 30 hours to get everything back on track. In addition, the USCG says that at a minimum, the following measures may have prevented or limited the breach and decreased the time for recovery:

Intrusion Detection and Intrusion Prevention Systems to monitor real-time network traffic
Industry standard and up to date virus detection software
Centralized and monitored host and server logging
Network segmentation to prevent IT systems from accessing the Operational Technology (OT) environment
Up-to-date IT/OT network diagrams
Consistent backups of all critical files and software

According to a news report, this is not the first time this has happened. Just six months ago, the Coast Guard issued an advisory regarding cybersecurity attacks against shipboard networks. Homeland Security considers the Coast Guard critical infrastructure, and cyberattacks are taken seriously.

ON DEMAND: Business-impacting events such as severe weather, man-made disasters, and supply chain disruption are increasing in frequency and making impacts around the globe.

In today's rapidly evolving security landscape, organizations face an ever-growing array of disruptive events, security threats and risks. Traditional reactive approaches to security intelligence often leave businesses vulnerable and ill-prepared to anticipate and mitigate emerging threats that could impact the safety of their people, facilities or operations.