Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Technion Institute of Technology in Israel fell victim to a ransomware attack.
The attack was claimed by DarkBit, a new ransomware group that aims to associate its actions with hacktivism.
According to the ransomware note, the attack is a way of protesting against ”firing high-skilled experts”. Another stated reason is the ”war crimes against humanity” that DarkBit considers Israel has committed.
What the Ransomware Attackers Demand
In one of their recent tweets, DarkBit advice tech companies to beware of how bad treatment of talented former employees might turn into a cybersecurity risk:
A kindly advice to the hight-tech companies: From now on, be more careful when you decide to fire your employees, specially the geek ones [sic].
However, DarkBit was also clear and ferm on their ransomware demands. They asked for 80 Bitcoin, which is about $1.7 Million, payment in order to release the decryptor. The threat actors also stated they will add a 30% penalty if Technion refuses to make the payment within 48 hours. Further on, if they don`t get the money in five days, the hackers threaten to put the data for sale.
How Did the Attack Happen
For now, Technion`s website was put offline. Both researchers and the authorities are investigating what happened and trying to mitigate the effects of the attack.
To carry out the process of collecting the information and handling it, we use the best experts in the field, both within The Technion and outside, and coordinate with the relevant authorities. The Technion has proactively blocked all communication networks at this stage.
According to the ransomware note, the files were encrypted using an AES-256 military grade algorithm. The threat actors claim that any try to recover the data without using the proper key will damage the files permanently.
Even if the Institute`s network was impacted, the university’s campus will continue to work as usual, except for some postponed exams.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.
