San Francisco Muni hit by Black Friday ransomware attack

reader feedback 1
Percentage this tale
Black Friday was once a black day for San Francisco’s Municipal Transportation Company, as an obvious crypto-ransomware an infection unfold around the Muni gadget’s networks, taking down ticketing for Muni’s teach stations and techniques used to regulate the town’s buses.

The operator of the ransomware demanded $73,000 in alternate for recovery of Muni’s information, in keeping with a document from the San Francisco Examiner.
The malware’s results have been visual on displays in station brokers’ cubicles at more than one Muni teach stations, which displayed the message, “You Hacked, ALL Knowledge Encrypted.” The ransom message gave an e mail cope with ([email protected]) that has been tied to ransomware assaults with variants of malware referred to as Mamba and HDDCryptor, a category of crypto-ransomware first known from other samples in September by Morphus Labs and Development Micro.
A mash-up of a few elementary malware code with open supply and freeware Home windows tool, HDDCryptor is going after all the community of its sufferers—encrypting complete native and networked drives.

The malware makes use of an open supply disk encryption software referred to as DiskCryptor and identifies bodily and community stocks to encrypt the use of Home windows’ “GetLogicalDrives” quantity control serve as.
It additionally makes use of code from the unfastened community password restoration tool Netpass.exe. HDDCryptor then overwrites the Grasp Boot File of the inflamed system—in some instances forcing a reboot of the gadget—to show its message.
On Friday and Saturday (November 25 and November 26), Muni teach stations’ gates have been open—with price tag machines exhibiting “out of order” messages, passengers have been allowed to journey totally free.

The Examiner stories that bus drivers got hand-written path assignments.
By Sunday, lots of Muni’s techniques have been it sounds as if restored. It’s not transparent if SFMTA paid the ransom demanded or if techniques have been restored from a backup.

Ars tried to touch SFMTA for additional main points however gained no reaction.