police department ransomware incident INVOLVES Ransomware
The police department was hit by ransomware across its network.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“It was ransomware across the entire network.”
Incident
incident:police_department_ransomware_incident
Ransomware incident that disabled the police department’s systems, patrol vehicles, and some connected city laptops.
Ransomware incident that disabled the police department’s systems, patrol vehicles, and some connected city laptops.
“It took down the patrol vehicles, it took down the entire police department”
“The latest backup they had was from ten months ago”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Ransomware | Explicit | 96 |
| outgoing | INVOLVES | backup failure | Explicit | 96 |
| outgoing | INVOLVES | Domain controller | Explicit | 96 |
| outgoing | COMPROMISES | Domain controller | Explicit | 96 |
| outgoing | INITIAL_ACCESS_VIA | Remote Desktop exposure | Explicit | 96 |
| outgoing | INVOLVES | Remote Desktop | Explicit | 96 |
| outgoing | INVOLVES | phishing email | Explicit | 96 |
| outgoing | INVOLVES | keylogging | Explicit | 96 |
| outgoing | INVOLVES | shared administrator credentials | Explicit | 96 |
| outgoing | INVOLVES | the mayor of the city | Explicit | 96 |
police department ransomware incident INVOLVES Ransomware
The police department was hit by ransomware across its network.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“It was ransomware across the entire network.”
police department ransomware incident INVOLVES backup failure
The incident involved untested and outdated backups; the latest usable backup was ten months old.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“they did not test their backups prior to deploying them”
“The latest backup they had was from ten months ago.”
police department ransomware incident INVOLVES Domain controller
The attack involved the police department's domain controller, which was accessible and later used to stage malware.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this police station’s domain controller was accessible from the internet over Remote Desktop”
police department ransomware incident COMPROMISES Domain controller
Unauthorized administrators logged into the domain controller and an attacker uploaded malware to stage another ransomware infection.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this user did upload some malware and looks like they were staging it to infect the network with ransomware again”
police department ransomware incident INITIAL_ACCESS_VIA Remote Desktop exposure
The episode attributes the ransomware access to the domain controller being exposed to the internet through Remote Desktop.
Explicit Confidence 97% · Jack Rhysider EP 96 Details
“the police department was hit with ransomware because this system was accessible from the internet”
police department ransomware incident INVOLVES Remote Desktop
The attacker and legitimate users accessed the domain controller through Remote Desktop.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“admin credentials to this server, to RDP in”
police department ransomware incident INVOLVES phishing email
A later investigation found that a phishing email led to credentials being stolen from the mayor's computer.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“they were able to find a phishing e-mail. There was credentials stolen.”
police department ransomware incident INVOLVES keylogging
The attacker used a keystroke logger on the mayor's computer to observe credentials typed during a Remote Desktop login.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“The attacker put a keystroke logger on the computer and watched what the mayor did.”
police department ransomware incident INVOLVES shared administrator credentials
The incident involved shared administrator credentials used by the mayor, city council members, and others.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“we all have the admin credentials; they’re all the same”
police department ransomware incident INVOLVES the mayor of the city
The mayor's home computer and credentials were part of the attack path; the episode does not conclude that the mayor himself conducted the attack.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“There was somebody in the mayor’s computer that ended up gaining access to the server through the mayor’s home computer.”