Weekly Watch June 3-7, 2019

In the Spotlight This Week

Since May 7, the city of Baltimore has been trying to recover from a paralyzing RobbinHood malware attack. Email, voicemail, and payment systems for water bills, property taxes, parking fines, vehicle citations, and real estate transactions. Since then, the city has been struggling to cope by using technological alternatives and even manual workarounds for daily operations.

While no one knows the identity of the attacker, the security firm Armor is pretty confident that it is the same bad actor behind the (now suspended) Twitter account @Robihkjn (Robbinhood). This owner of the account posted a series of tweets featuring links to allegedly stolen documents, pressuring the Baltimore government officials to pay the 13 bitcoin, or approximately $100,000 ransom.

Baltimore’s ransomware woes have triggered nearly $18 million in in financial losses, as well as various accusations of blame. It was reported that the NSA’s Eternal Blue exploits of that flaw were to blame. However, later cybersecurity expert Brian Krebs reported that “while Eternal Blue could have been used to spread the infection, the RobbinHood malware itself contains no traces in it.”

For more information:

Baltimore City Government Computer Network Hit by Ransomware Attack

Analysis of Ransomware Used in Baltimore Attack Indicates Hackers Needed 'Unfettered Access' to City Computers

Robbinhood: Inside the Ransomware That Slammed Baltimore

Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware

Baltimore’s Bill for Ransomware: Over $18 Million, So Far

REN-ISAC

Weekly Watch June 3-7, 2019

In Case You Missed It

In the Spotlight This Week

Research & Education Networks Information Sharing & Analysis Center