The Colonial Pipeline Attack, what's the latest? Who's behind it? And how should we respond? These stories and more, in this week's ISMG Security Report.
Hi, I'm Anna Delaney. The story on everyone's mind this week is, of course, the Colonial Pipeline ransomware attack, which occurred last Friday and has been considered as one of the most significant attacks on critical national infrastructure in history. Therefore, this week, we are dedicating the security report entirely to the incident for some in-depth analysis. First, we need to share some insight on what we know so far is my colleague Scott Ferguson, managing editor for Guv in for Security.
So Scott, you've been reporting on this story since it broke. What do we know to date? Well, Anna, here's what we know so far. The incident was first reported on Friday.
Colonial put out a statement on Saturday and eventually we found out it was a ransomware attack. The FBI would later come out and say that the perpetrators, in this case, use a ransomware variant called Darkside. Darkside is developed by a ransomware as a service group as of the same name. It's affiliates also use the same ransomware.
So right now, we're not sure of which group actually attacked Colonial. The FBI isn't saying, and certainly Colonial's not saying. What we also do know right now is that as of 5 p.m. Eastern time on Wednesday, Colonial said that they would be restarting their operations, getting their IT systems back up online, but it would take a few days or maybe even a couple of weeks to bring all their supply chains back up to normal and also to get the flow of petroleum products, whether that's gasoline, jet fuel, home heating oil, back up and running and back out to their customers, which includes local folks.
It includes gas stations, the federal government. So it's a really fluid situation if I can use the pun right now. And that's where we are right now. We do know that they've reopened up operations.
At the same time on Wednesday night late, President Joe Biden signed an executive order looking at sweeping changes to cybersecurity within the federal government. So it's all kind of came out at once at the same time on Wednesday night. So basically that's where we are right now. Okay, and what's the response from the Biden administration?
Well, the Biden administration is kind of taking this holistic approach to it. So not only is it the FBI and SISA that are looking at the actual attack, the Department of Transportation, the Department of Energy, the Department of Treasury, other departments have been brought into this to sort of make sure that the fuel shortages stay contained, gas prices don't spike, and the situation can return to normal. At the same time, Biden did sign this executive order that was anticipated for several weeks. It was mostly related to what had happened at SolarWinds and Microsoft Exchange.
Obviously, Colonial was also taken into that as well. And they also pushed that out on Wednesday night at about the same time Colonial announced that they were opening. So it's a very much a whole approach that they're taking. They want to seem to be ahead of the news.
They don't want to seem to feel that the events are going to overtake them. So they've kind of pushed everything out. We've also seen in White House briefings, they brought out different Department secretaries to talk about different components of this. So it's really been an all-out effort on the Biden administration really since Saturday when this all had first started to come to light.
Here's US Secretary Jennifer Granholm on a Tuesday White House press conference talking about the impact of the attack. I want to be clear that these states who are impacted, even with the turning on of the pipeline system, they still may feel a supply crunch as colonial fully resumed. So, but the American people can feel assured that this administration is working with the company to get it resumed as soon as possible. And as one other warning, I guess, let me emphasize that much as there was no cause for say, hoarding toilet paper at the beginning of the pandemic, there should be no cause for hoarding gasoline, especially in light of the fact that the pipeline should be substantially operational by the end of this week and over the weekend.
So at the same time, it certainly is a reminder that we need to take a hard look at how we need to harden our necessary infrastructure. And that includes cyber threats. And as Ann Newberger, who was here yesterday and told you, this administration is taking an all-hands-on-deck approach to enhancing our cyber defenses. So it seems that there's been some frustration, Ed, from the cyber security community in the form of, well, we are well-passed wake-up calls.
And actually, this incident doesn't come as a surprise. And I said earlier, this is being considered as one of the most significant attacks in CNI history. So what's your take, Scott? What are the wider implications of this hack?
Well, and as you mentioned, there is some exasperation, let's say, about these ongoing attacks. We've had solar winds. We've had Microsoft Exchange. We've had the attacks that took advantage of whole secure VPNs.
Now you've had colonial. These are four major incidents that have all come to light in the last six months. And it's beginning to lead some people to ask what's going on here. You saw that a little bit in Washington DC this week on both Tuesday and Wednesday.
A lot of lawmakers are taking this opportunity to say, we need reach notification laws that's going to require some mandatory reporting from both government agencies and the private sector. You're having some lawmakers question, what's going on in terms of regulation? Why weren't the agencies that are in charge of pipeline security more aware of this? Did they know the cyber security problems with this?
Did they know the implications of something like this happening? I think the Biden order is trying to address some of that. You've seen the administration trying to get a handle on this. The Department of Justice has come out and said they'll have a ransomware task force that's going to be taking a more holistic approach to ransomware.
They'll be doing more to break up the criminal enterprises themselves. You've had some private industry folks get together and say we need more regulation around cryptocurrency such as know your customer and some other ways that can better track the transactions that come to Bitcoin since this is the currency that most of these cyber actors are using as part of their ransom schemes. So I think there's frustration on one point, but I also think we're moving toward this sort of larger take on what ransomware can do and what better ways to tackle it. I think it's a still wait and see of how much the executive order that came out this week will actually do to solve some of these issues.
It's going to be on the federal government and then we'll see what happens within private industry. You're listening to the ISMG security report on ISMG radio, ISMG, your number one source for information security news. So who are Darkside, the ransomware gang responsible for the attacks? Well, with me to answer this question is our resident ransomware expert, an executive editor of Data Breach today in your Matthew Schwartz?
So Matt, what do we know about Darkside? Well, Darkside is an up and coming ransomware-as-a-serve operation that looks to have been launched around August 2020 and then come November 2020 was advertising for a couple of different kinds of affiliates. So most ransomware gangs these days have gone with these ransomware-as-a-service model where the operator will develop the malware, the crypto locking, and they'll sign up some affiliates who will take that and in fact, victim, when victims pay, they do so typically be a portal maintained by the operators or get a Darkside in this case. And then they split the revenue.
In the case of Darkside, it was a really big ransom. The affiliate keeps about 90% and the operator takes about 10%. But if you imagine that some of these ransoms look to be maybe $2 million an up, every payment can be extremely lucrative. And so a lot of these ransomware-as-a-serve operations have been earning money hand over fist.
And Darkside seems to be no different. Here's Sam Curry, CSO of Cyber Reason, talking about how these organizations, these criminal syndicates, get run. Ransomware is really a business model. And I can't emphasize that enough.
The reason it's exploding, the reason it's growing is because people make money at it and they make a lot of money. Insurance companies have been paying. It's important to realize that victims have been paying, but they're targeting the sectors that are most likely to pay. Ransomware has a service.
It's a business model. And in their copying what we do in the real economy, this is almost profit sharing or revenue sharing. And as people go into business with Darkside. Samat, you've said your surprised aid disruption might have been sooner.
Why? The easy answer is that ransomware gangs are opportunities based on what we've seen. So many attacks appear to have just been maybe not happening. But in organization, maybe had a poorly protected remote desktop protocol, installation running, and some initial access brokers got access to the network.
And then they were able to sell it on. So that doesn't be speak any particular organization necessarily having been extensively before they were targeted. But more of this just mask harvesting. And so it's very likely that colonial pipeline just came up in this sort of look for organizations that might be broken into.
There's probably some degree of reviewing the organization's in question, seeing who might be especially potentially lucrative. And colonial pipeline probably passed that test in states, right? Given the fact that it supplies petroleum products to the East Coast and the United States. The attackers probably weren't thinking, uh oh, privately run critical infrastructure might not be good for the brand.
Also, you know, Darkside is an operation. They work with affiliates. Affiliates might not have a lot of allegiance with any given ransom robbery. A lot of them can and do help around when they get a better deal.
A larger take for any given ransomware payoff or fair tools at this or that ransomware operator. There's a lot of competition for the affiliates because many of them are extremely well skilled. So there's this huge profit in there. And as we've seen with hospitals getting hit, ideally, of course, hospitals wouldn't get hit.
Do the criminals care? Doesn't look like it. They're just looking for anybody who might pay. And so eventually they're going to start hitting pieces of the critical national looters.
So the question on everyone's mind is, is the Russian government involved? And my clear answer there, Anna, is definitely maybe really, we don't know. If you talk to intelligence officials, they're saying things like Putin's lab. He's loving this.
I do think that from a geopolitical perspective, the Russian government, obviously, they read the news. Now, are they actively incubating these ransomware gangs, you know, taking high performing youth, putting them into high caliber Russian universities, graduating them and saying, you know, go forth in ransomware? It's not really. Obviously, there's long been this element of cyber crime allowed to operate.
And lots and lots of security experts will say that they are allowed to operate with the government turning a blind eye. So long as they agree to do the case of favor, so long as they don't hit any Russian targets, if they do, we've seen them get taken down faster than you can. So there's definitely some kind of nudge, nudge, wink going on. I think if I was the Russian government, this is pretty funny, might be the wrong word, but you're watching the US get disrupted left, right by criminal guy.
And if you are the Russian government, you have easy plausible deniability for anything to do with it, except perhaps for foster. So we know that the gang is probably Russian speakers, but we don't really know if they might be moles or plants or just allowed to do their criminal. And this is a question also put to Sam Curry. And it's worth hearing his risk.
Well, it's hard to say at this point, but I wouldn't be surprised to find any nation state behind it. The difficult thing is that we often go, is this nation or that nation, and we forget that there's dozens of agents within the nation. There are probably Russian people involved. And a lot of this is tied into various parts of various countries, economies.
So the real question is, how do we deal with them as an entity? As they evolve, they adapt intelligently, they find new techniques. And frankly, it doesn't really matter who they are so much as what they do. So there's an old adage.
You shouldn't worry about nation state attackers. If you have so many vulnerabilities that were teenagers, crime gangs, activists, script kitties, or anybody else who take advantage of you, if it's that easy to exploit your networks, you've got super serious problems. And unfortunately, the ransomware hits you see and keep turning up are a lot of really important things. And finally, how should the US respond to such an attack on critical infrastructure?
Phil writing a CEO of the Global Cyber Alliance shed his opinion with our senior vice president of editorial Tom Field on why it's time for an overreaction. It's very, very hard to deter. And I would say, in our current environment, impossible to deter all cyber crime. It's just too easy to do, right?
But these sorts of attacks that can have national economic consequences, absolutely call for, and I'll use this term advisedly, an overreaction on behalf of government. It's time for a disproportionate response. If a nation is involved in providing a safe haven for this sort of group, and you know this group did it, or at least you have high confidence and you know where they came from, then it's time to say you're giving us these people and we're going to extradite them. And if you don't, then the consequences on you are going to be economically so significant that this will never happen again.
It's time for that sort of response. That's it from the Eyes and G Security Report. Theme music is by Ipaca Audio. I'm Anna Delaney.
Until next time.