Tuesday, February 11, 2025
HomeMalwareU.S. Coast Guard Computer Systems Infected by “Ryuk” Ransomware That Encrypts...

U.S. Coast Guard Computer Systems Infected by “Ryuk” Ransomware That Encrypts IT Network-Based Critical Files

Published on

SIEM as a Service

Follow Us on Google News

U.S. Coast Guard discloses a ransomware attack on a Maritime Transportation Security Act (MTSA) regulated facility by infamous “Ryuk” Ransomware.

“Ryuk” Ransomware involved with so many attacks that targeted various organizations, government networks and cause millions of dollar damages.

GBHackers recently reported that hackers compromise the U.S Massachusetts city computers with the Ryuk Ransomware and demanding $5.3 million to unlock the compromised computers.

Also, The National Cyber Security Centre (NCSC) from the UK issued an alert for the Ryuk ransomware attack in July that is actively targeting global organizations associated with Emotet and TrickBot malware.

After the successful infection of Ryuk ransomware, All the non-executable files will be encrypted at the end of the infection process and displaying the ransomware notes with the demand of the ransom amount in bitcoin.

In this current attack in U.S. Coast Guard’s MTSA Facility Operations targeted via phishing email campaign, and trick the employees to execute the embedded malware link associated with the email.

“Ryuk Ransomware let threat actors access significant enterprise Information Technology (IT) network files, and encrypt them, preventing the facility’s access to critical files.”

The ransomware also propagates into the industrial control systems that monitor and control cargo transfer and encrypted files critical to process operations.

According to the report, The infection causes severe damage in the MTSA systems includes the following:

  • Entire corporate IT network
  • Disruption of camera
  • Disruption of physical access control systems
  • Loss of critical process control monitoring systems

The Coast Guard recommends facilities utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and NIST Special Publication 800-82 when implementing a Cyber Risk Management Program.

Coast Guard warned maritime stakeholders to verify the validity of the email sender prior to responding to or opening any unsolicited email messages to prevent the cyber attacks.

Also Read: Ransomware Attack Response and Mitigation Checklist

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

OpenAI Developing Its Own Chip to Reduce Reliance on Nvidia

OpenAI, the organization behind ChatGPT and other advanced AI tools, is making significant strides...

New York Bans DeepSeek Over Potential Data Risks

 New York Governor Kathy Hochul announced that the state has banned the use of...

Hackers Exploit Valentine’s Day Domains for Sneaky Cyber Attacks

Cybercriminals are capitalizing on the season of love to launch sneaky and deceptive cyberattacks.According...

EARLYCROW: Detecting APT Malware Command and Control Activities Over HTTPS

Advanced Persistent Threats (APTs) represent a sophisticated and stealthy category of cyberattacks targeting critical...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

EARLYCROW: Detecting APT Malware Command and Control Activities Over HTTPS

Advanced Persistent Threats (APTs) represent a sophisticated and stealthy category of cyberattacks targeting critical...

Akira Ransomware Dominates January 2025 as the Most Active Ransomware Threat

January 2025 marked a pivotal month in the ransomware landscape, with Akira emerging as...

FinStealer Malware Targets Leading Indian Bank’s Mobile Users, Stealing Login Credentials

A new cybersecurity threat has emerged, targeting customers of a prominent Indian bank through...