Ransomware criminals are targeting US universities

As COVID-19 cases in the U.S. continue to climb^[1], government and higher education leaders have been focused on doing what it takes to protect campus communities from the global pandemic.

But college and university leaders would be wise if they were just as vigilant about protecting their sensitive data from the cybercriminals who are becoming increasingly sophisticated about encrypting the colleges’ data and making the colleges pay a ransom to get it back.

One of the latest examples is a ransomware attack^[2] that struck the University of California, San Francisco on June 1. In that case, cybercriminals used the NetWalker malware to encrypt data on the servers of the university’s school of medicine. This malware targets corporate networks and encrypts the data it finds on the attacked devices^[3]. This means that the device owner cannot access data on the device until a ransom in cryptocurrency demanded by the criminal is paid^[4]. The criminal gang behind NetWalker has victimized dozens of organizations^[5].

UCSF said that the attackers breached important data related to its medical school faculty’s research^[6]. It says its COVID-19 research was not affected^[7].

Such ransomware attacks on universities have become common^[8]. In 2019 alone, 89 U.S. universities, colleges and school districts^[9] became victims of such attacks, followed by at least 30^[10] in the first five months of 2020.

Along with the financial services industry, the education sector^[11] is one of the two most common targets of these attacks.

Attempts to extort

I research^[12] cybercrime^[13] and cybersecurity^[14]. I’ve learned that obtaining ransom payments from their victims is the biggest challenge^[15] most cybercriminals face, and that universities perform poorly on cybersecurity. Their vulnerabilities are becoming easier to exploit thanks to cryptocurrencies, such as bitcoin, which make it easier for cybercriminals to extract payments^[16] from their victims.

In the case of UCSF, university officials transferred 116.4 bitcoins – the equivalent of US$1.14 million – ^[17] to the cryptocurrency wallet of the NetWalker gang and received the key to decrypt its own files^[18] in return.

NetWalker is sophisticated malware. To distribute ransomware, NetWalker creators rely on phishing and spam as well as other large-scale network infiltration^[19] such as hacking unsecured wireless devices connected to Wi-Fi networks.

After penetrating a network, it can render antivirus software useless^[20].

[You’re smart and curious about the world. So are The Conversation’s authors and editors. You can get our highlights each weekend^[21].]

The criminal group behind NetWalker mainly pursues high-value targets^[22], such as the Champaign-Urbana Public Health District in Illinois^[23] and Michigan State University^[24].

The creators of NetWalker are believed to collaborate with about 10 to 15 affiliates^[25] to distribute the malware. The affiliates, who are often less skillful criminal hackers than the creators of NetWalker^[26], infiltrate a victim’s network and infect it with the ransomware. They later split any ransom money obtained with NetWalker’s creators.

Why higher ed is a target

In my view, colleges and universities have become attractive targets for cybercriminals because of their weak cybersecurity measures. Research shows that the education sector^[28] is the least-prepared to fend off cyberattacks^[29]. In a vulnerability test of U.K. universities, hackers obtained sensitive and valuable data in all cases within two hours^[30].

University networks contain highly sensitive information related to research, patents and other types of intellectual property data. These are targets cybercriminals desire.

Most students use the universities’ wireless networks to access information. Email addresses and other information about faculty, staff and students are easily available. Cybercriminals can use such information to send phishing emails.

It doesn’t help that some universities rely on outdated and insecure software^[31]. Or that departments and individual professors^[32] store some of the most sensitive data without help from cybersecurity specialists within their universities.

To pay or not to pay

Generally law enforcement agencies^[33] and cysersecurity professionals^[34] oppose paying ransom. The FBI has suggested that victims report to law enforcement, whether or not they are willing to make those payments^[35].

Extortionists promise to provide the victims with encryption keys for unlocking encrypted data if ransom is paid. NetWalker and some other ransomware criminals threaten to publish victims’ data^[36] on information leak websites^[37] otherwise.

Many victims distrust the extortionists and doubt their promises to unlock data after ransom payments^[38]. This fear is well-founded. In 2016, only a quarter of organizations^[39] that paid ransoms recovered their data.

Desperate victims may decide to pay, hoping that the criminals behind the attacks fulfill their promise to decrypt data. Cornell University reportedly bought bitcoins^[40] to pay to extortionists in case of a future ransomware attack. If companies rely on data, paying ransom could be less costly than the alternative.

Recently, ransomware criminals are becoming more selective^[41], going after only victims for whom data is extremely important.

Some recent victims of NetWalker also reported that they successfully recovered most of their data after paying the ransom. In March, NetWalker had hijacked the computer networks of the Champaign-Urbana Public Health District^[42] in Illinois, which serves 210,000 people including the University of Illinois. After paying a $350,000 ransom^[43], the Champaign-Urbana Public Health District retrieved 99% of its files^[44].

A growing number of organizations now buy cyber insurance to protect against future losses^[45] from these attacks. An insurer, for example, paid all but $10,000 of the Champaign-Urbana Public Health District’s ransom^[46].

Tracking ransomware perpetrators

Most ransomware criminals, however, operate from jurisdictions that don’t cooperate with the U.S. or European authorities fighting cybercrimes. For instance, the criminals behind NetWalker are believed to operate from Russia or other Commonwealth of Independent States^[48].

To shore up their digital security, universities should mandate strong passwords and encourage all faculty, students and staff to report fake emails and other incidents. It would also help if they could constantly back up important data and purchase cyber insurance.

References

1. ^{^} continue to climb (coronavirus.jhu.edu)
2. ^{^} ransomware attack (www.govtech.com)
3. ^{^} targets corporate networks and encrypts the data it finds on the attacked devices (www.tripwire.com)
4. ^{^} until a ransom in cryptocurrency demanded by the criminal is paid (www.incibe-cert.es)
5. ^{^} victimized dozens of organizations (www.star-telegram.com)
6. ^{^} to its medical school faculty’s research (www.ucsf.edu)
7. ^{^} COVID-19 research was not affected (threatpost.com)
8. ^{^} common (www.jamesgmartin.center)
9. ^{^} 89 U.S. universities, colleges and school districts (blog.emsisoft.com)
10. ^{^} at least 30 (edscoop.com)
11. ^{^} the education sector (labs.sentinelone.com)
12. ^{^} research (scholar.google.com)
13. ^{^} cybercrime (www.sciencedirect.com)
14. ^{^} cybersecurity (www.palgrave.com)
15. ^{^} biggest challenge (www.palgrave.com)
16. ^{^} make it easier for cybercriminals to extract payments (theconversation.com)
17. ^{^} 116.4 bitcoins – the equivalent of US$1.14 million – (www.bbc.com)
18. ^{^} received the key to decrypt its own files (threatpost.com)
19. ^{^} phishing and spam as well as other large-scale network infiltration (threatpost.com)
20. ^{^} render antivirus software useless (www.computing.co.uk)
21. ^{^} You can get our highlights each weekend (theconversation.com)
22. ^{^} high-value targets (labs.sentinelone.com)
23. ^{^} Champaign-Urbana Public Health District in Illinois (siliconangle.com)
24. ^{^} Michigan State University (cointelegraph.com)
25. ^{^} 10 to 15 affiliates (www.bleepingcomputer.com)
26. ^{^} often less skillful criminal hackers than the creators of NetWalker (threatpost.com)
27. ^{^} Westend6/GettyImages (www.gettyimages.com)
28. ^{^} education sector (edtechmagazine.com)
29. ^{^} least-prepared to fend off cyberattacks (securityscorecard.com)
30. ^{^} within two hours (www.bbc.com)
31. ^{^} outdated and insecure software (www.zdnet.com)
32. ^{^} departments and individual professors (www2.deloitte.com)
33. ^{^} law enforcement agencies (www.ic3.gov)
34. ^{^} cysersecurity professionals (www.theguardian.com)
35. ^{^} whether or not they are willing to make those payments (www.ic3.gov)
36. ^{^} threaten to publish victims’ data (www.tripwire.com)
37. ^{^} information leak websites (www.zdnet.com)
38. ^{^} unlock data after ransom payments (www.computer.org)
39. ^{^} only a quarter of organizations (www.salon.com)
40. ^{^} Cornell University reportedly bought bitcoins (www.technologyreview.com)
41. ^{^} are becoming more selective (threatpost.com)
42. ^{^} hijacked the computer networks of the Champaign-Urbana Public Health District (siliconangle.com)
43. ^{^} $350,000 ransom (gcn.com)
44. ^{^} retrieved 99% of its files (www.smartbrief.com)
45. ^{^} cyber insurance to protect against future losses (www.sciencedirect.com)
46. ^{^} all but $10,000 of the Champaign-Urbana Public Health District’s ransom (gcn.com)
47. ^{^} seksan Mongkhonkhamsao/GettyImages (www.gettyimages.com)
48. ^{^} Russia or other Commonwealth of Independent States (www.tripwire.com)