University of California, San Francisco (UCSF) Ransomware Attack
Case Study: University of California, San Francisco (UCSF) Ransomware Attack
Description of the Attack
On 1st June, the Netwalker ransomware campaign’s hackers launched an attack on UCSF networks inside the faculty of Medicine’s IT infrastructure. Although this did not affect patient care services or research efforts to develop a treatment regarding COVID-19, information on “several servers” was encrypted effectively, conforming to UCSF affirmation dated 26th June. IT experts disconnected machines to halt the spread of the infection. BBC News monitored the cybercriminal discussions in real-time via a dark web chat room (BBC News June 2020). According to cyber-security specialists, these kinds of conversations are now taking place worldwide – sometimes for much greater numbers – despite the advice of policies enforcement organizations such as the Europol, FBI, and the United Kingdom’s National Cyber Security Centre. Netwalker has been linked to at least two further ransomware assaults on institutions in the last two months. At first sight, the dark-web homepage seems to be a typical customer support website, complete with FAQs (frequently asked questions) section, an attempt of “free” testing of the program, along with live-chat features. However, there is a timer meter counting down to which the criminals will either double the attack or remove the data they have mangled with malware.
According to the BBC, the hackers first demanded a $3 million (£2.4 million) ransom; however, this was bargained down to $2 million (£2.4 million) by a UCSF frontman “who may be a specialized negotiator outside the organization.” According to a UCSF spokesperson, assuming that anything in the negotiation affirmations was “factually precise ” would be a “mistake.”
Directed to log in – by ransom notation or email dispatched on attacked computer displays – UCSF had the following information, posted 5th June (BBC News June 2020).
After six hours, the institution requested additional time and the removal of facts about the attack from Netwalker’s public blog.