Florence, Ala. Hit By Ransomware 12 Days After Being Alerted by Krebs OnSecurity
Summary: KrebsOnSecurity alerted Florence, Alabama officials on May 26 that a Windows 10 system in their network had been commandeered by a ransomware gang, after Hold Security traced a May 6 DHL-themed phishing attack that stole the credentials of the city's IT manager. On June 5 the intruders deployed DoppelPaymer ransomware, initially demanding 39 bitcoin (~$378,000) and negotiating down to 30 bitcoin (~$291,000), which Mayor Steve Holt said the city plans to pay to keep citizens' personal data offline.
Why it matters: The city was warned 12 days before the attack, isolated the flagged account, and was still hit - and its IT manager said the city was mid-way through seeking council approval for a fuller investigation when the ransomware landed, a reminder that a known intrusion is not a contained one.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·