Ransomware, a form of malware, encrypts files and blocks users in return for a ransom payment. In 2021, ransomware attacks accounted for 22% of cybersecurity incidents and were up 100% from 326 in 2020 to 654. Many of these style of cyber attacks occur monthly, but there are two notable ransomware attacks that have extorted millions of pounds from organisations in the UK and beyond.
Notable UK ransomware attacks
Ryuk
What is Ryuk?
Ryuk ransomware first appeared in 2018 and has since been used to target large companies. Once a system is infected, the ransomware encrypts all data until a payment is made via untraceable bitcoin. Victims include several US organisations, hospitals and publications. In the UK, the malware is believed to be responsible for Eurofins Scientific (the UK’s biggest forensic and scientific services) hack.
How did Ryuk work?
In the UK, Ryuk uses the computer malware Trickbot to install itself. Typically, Ryuk infiltrates via phishing emails when people open a malicious Microsoft Office attachment. The attachment prompts the download of a Trojan called ‘Emotet’ which then collects user data. The ransomware often remains undetected after the infection for several days or even months. This gives cyber criminals time to explore and assess the network to decide whether they have enough leverage to extort a significant amount.
How was it stopped?
Ryuk hasn’t been stopped and cyberattacks using this ransomware are still occurring today. The hackers behind Ryuk deliberately target organisations who they believe will pay large sums. This means an encryption key to recoup the data is only given once the ransom is paid. To prevent infection and limit the risk of attack, businesses should install good quality anti-malware software.
What was the cost?
The FBI believes that more than $68m in ransom was paid to Ryuk between 2018 and 2019. Since then, tech firm Sopra Steria was targeted, and it is believed that attack alone cost between $47–59m. In the UK, Eurofins Scientific’s paid an unknown ransom to regain access to their IT systems but not before it caused a backlog of 20,000 blood and DNA samples.
Who launched the ransomware?
It is believed that two criminal groups use Ryuk ransomware to attack corporations. Initially suspected to be North Korean, it has now been linked to Russian organised crime.
WannaCry
What is WannaCry?
On 12th May 2017, WannaCry – the UK’s most infamous ransomware attack – was launched. The global attack, which used a ransomware cryptoworm, targeted computers running on unsupported and out of date versions of Microsoft Windows like XP and Server 2003. The malicious software encrypted files, preventing user access, and demanded a Bitcoin payment as a ransom.
How did WannaCry work?
The attack used a hack, purportedly developed by United States National Security Agency, called EternalBlue. Just two months before the attack, Microsoft had released a security patch designed to protect their systems against this. However, several organisations didn’t update their computers and were left vulnerable. The ransomware wasn’t spread via a phishing campaign (malicious or spam emails with infectious links or attachments) but by an SMB port.
How was it stopped?
Marcus Hutchins, a British cybersecurity researcher, discovered a kill switch in the afternoon of 12th May. This prevented any further infections and halted the attack. Hutchins was on holiday at the time but turned his attention to reverse engineering the code and registered a domain name which acted as the kill switch.
What was the cost?
Across 150 countries, around 200,000 computers were infected. The NHS was badly hit with 70,000 devices – from refrigerators to MRI scanners and computers – affected. It emphasises the important of good healthcare cybersecurity as on the day of the attack, many NHS services couldn’t operate and turned away any non-critical emergencies. Car makers like Nissan and Renault stopped production and other well-known brands like Hitachi, FedEx and Deutsche Bahn were also impacted. Those targeted were advised not to pay the ransom. But by June 2017, after the attack ended, over £100,000 had been transferred to the hackers from 327 payments. The total cost of the attack is significantly greater as Cyence, a cyber-risk modelling firm, predict losses could reach $4 billion.
Who launched the ransomware?
In December 2017, the US government announced they believed North Korea were behind the WannaCry outbreak. This was based on evidence that suggested Kim Jong-un gave the order and the attack used similar code to another North Korean hacking group. The Foreign and Commonwealth Office in the UK agreed with the US assessment, but Korea have denied responsibility.
Resources:
Ransomware remains a serious threat, despite enhanced security capabilities that come out of the box in the cloud.
In this article, we understand how zero trust can be a defense mechanism against ransomware attacks.
