Information security specialists say that there are an increasing number of incidents of cyberattacks in schools or government institutions in the U.S. Just yesterday, a cybersecurity emergency declaration was released in the state of Louisiana, after the governor reported that a variant of malware had infected the computer systems of multiple academic institutions.
Now, Alabama authorities have reported a cybersecurity incident that has compromised systems for an as yet undetermined number of schools in the Middletown school district.
Michael Conner, school superintendent, mentioned that this is a ransomware infection, adding that authorities have not paid any ransom to hackers. “We are collaborating with information security specialists to determine how hackers entered our systems; we will also implement a recovery process as soon as possible”. Two of Middletown’s six computer systems are operating with multiple limitations.
On the other hand, Mayor Daniel Drew said local government systems operate normally; however, the county’s IT staff is working to monitor, detect, and prevent potential attacks. “We are working really hard to prevent any new incident. The fiscal year is about to end and we cannot allow our activities to be crippled by a computer virus,” the Mayor added.
Among the most recent ransomware victims in the U.S. are:
- Alabama School Districts
- Oklahoma City public schools
- Montebello Unified School District, California
- Sugar-Salem School District, Idaho
- Connecticut School Districts
- Schools and government offices in Florida
- Ohio schools
- Louisiana School Districts
- Schools in Syracuse and the Onondaga County Library, New York
Ransomware attack incidents keep affecting government institutions, businesses and individuals across the country. Information security specialists claim that these infections commonly start with a phishing attack. “Pretending to be an Education Department official, a threat actor could trick members of schools’ administrative staff into delivering contact information, primarily emails”, mentioned the experts.
The attackers then send school staff emails with attachments waiting for the victim to download them to their devices. Once the victims open these files, it releases a virus that blocks access to all files on a system, demanding up to $10k USD to restore the access.
Information security specialists from the International Institute of Cyber Security (IICS) have detected some of the most common variants among recently detected infection cases. Although harmful capabilities and infection methods may vary, all of these malware aim to the same goal: to get a ransom.
The five types of ransomware most used in school attacks in the U.S. are:
- Cryptomalware: This is a fairly common form of ransomware and can cause great damage. One of the best-known examples is the WannaCry variant, which in 2017 was used to attack thousands of targets worldwide; reaching the networks of some of the world’s largest corporations
- Locker: This type of ransomware is known for infecting an operating system to completely block the victim from their computer, disabling access to any file or application
- Scareware: This is fake software that acts like an antivirus or cleaning tool. Once installed, the scareware shows the victim a message that claims to have encountered a problem on their computer and demands a payment for its solution. Some types of scareware may even lock a computer, while others may spam supposed security messages on the user’s screen
- Doxware: Also known as leakware, this ransomware variant threatens victims with posting online private information if the ransom is not paid. People store hundreds, even thousands of sensitive files on their devices (photos, login credentials, bank details, etc.), so they are highly likely to panic and give their money away to attackers if they find messages of this kind
- Ransomware as a Service (RaaS): This is a service hosted online by malicious actors that anyone can hire to deploy ransomware campaigns against a particular target. When hired, hackers take care of everything they need to achieve the infection, from malware distribution and ransom transfers, to delivering the decryption keys
Protect your school
Although it is a basic security measure, it is worth reminding system administrators that all computers in a school must be protected with reliable antivirus tools with the latest updates installed. Other tools, such as email filters, help block most emails from malicious content. However, remember that these measures will not fully protect you, so they must be combined with appropriated information security policies and administrative staff awareness.
If case you’re not 100% sure:
- Don’t open any attachments or click on any links, and never forward or respond to a suspicious message
- Check the authenticity of the email with your colleagues to see if someone else received the same message
- If you do not have absolute certainty about the veracity or provenance of an email, you can contact the International Institute of Cyber Security (IICS) via e-mail info@iicybersecurity; by sending a screenshot of the suspicious email, highly trained staff in handling cybersecurity incidents will advise you what steps to take
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
