- We think the cyber threat
is increasing almost exponentially.
- Ransomware is becoming an increasingly severe
and pervasive problem.
- We all have a role to play
in keeping our nation safe.
No organization is immune.
- We always thought we were small potatoes.
Who would pick a single library out
of the world to attack?
And that just goes to show
that it could happen to anybody.
- [Narrator] Ransomware is a practice hackers use
to lock up computer systems
and demand a payment from victims
for their release.
Data on ransomware attacks varies widely
and estimates are difficult to make
because many attacks are never made public
or reported to law enforcement.
But security officials agree,
the problem is rapidly getting worse.
These attacks are increasing in frequency,
victim losses are skyrocketing
and hackers are shifting their targets
away from data-rich companies
to providers of key public needs,
such as hospitals, transportation and food.
What's causing the current acceleration in frequency
and scope of these attacks?
There are at least four main factors.
First, victims continue to make cybersecurity mistakes,
like clicking on phishing links,
or failing to keep company software updated.
- These criminal groups are still finding it too easy
to exploit weak cybersecurity
or failure to execute cybersecurity best practices.
- [Narrator] A ransomware attack on Colonial Pipeline
forced a 5,500-mile pipeline to shut down for six days,
spurring a run on gasoline along parts of the East Coast.
Investigators believe hackers were able
to break into the company's computer systems
by logging into an out-of-use VPN profile
that lacked two-factor authentication.
The public library in Brownsburg, Indiana
found themselves in a similar situation in 2017.
- We believe the hackers came in
through our card catalog,
which is where you look for books.
It's open to the public,
so it's an open venue.
- [Narrator] The attack locked Robinson
and her staff out of email,
card holder information, and their entire library catalog
of over 100,000 items.
The library paid half of a Bitcoin,
approximately $1,300 at the time,
to regain access.
Second, ransomware attacks
have become very lucrative for hackers.
In the past several weeks alone,
JBS, whose meat plants
were temporarily knocked offline by cyber criminals
and Colonial Pipeline have paid many millions
of dollars to get their systems back up and running.
- Considering the consequences
of potentially not bringing the pipeline back on
as quickly as I possibly could.
I chose the option to make the ransom payment.
- [Narrator] Both the Colonial Pipeline
and JBS ransom payments were made using cryptocurrency,
which has a reputation for being hard to track.
But an announcement by the Justice Department
that they'd recovered about 2.3 million
of Colonial's initial ransom
demonstrates investigators' growing technical ability
in some cases to disrupt the financial infrastructure
that has enabled these ransomware gangs
to demand large sums.
- The sophisticated use of technology
to hold businesses and even whole cities hostage
for profit is decidedly a 21st century challenge.
But the old adage follow the money still applies.
- [Narrator] Cryptocurrency isn't the only reason
ransomware attacks have become more lucrative.
Some hackers are now utilizing double extortion tactics
in which they steal sensitive data
from their victims
before encrypting it and then threaten
to publish that information if victims refuse to pay.
Third, hacking groups have reinvented the process
through which criminal networks extort victims.
Ransomware-as-a-service is a practice
in which hacking networks
can sell or lease their ransomware software
to other criminal groups to carry out attacks.
Those affiliate groups
then share the proceeds with the hackers
who developed it.
DarkSide, the criminal group linked
to the Colonial Pipeline hack works in this way.
And finally, according to US officials
and cybersecurity researchers,
the majority of these hacks
are coming from Russia and Eastern Europe
where security experts say the line
between criminal hacking groups
and state-backed cyber operations can be murky
as governments often tolerate criminal activity
as long as it is targeted overseas
and sometimes even recruit hackers
from those groups to carry out their own objectives.
Following a highly anticipated summit
between President Biden and Vladimir Putin in Geneva,
the Russian leader said that he agreed
to start consultations on cybersecurity
and denied that Moscow was involved
in any cyber attacks.
At a separate news conference,
President Biden said he presented Mr. Putin
with a list of critical infrastructure
that he said should be off limits.
- Responsible countries need to take action
against criminals who conduct ransomware activities
on their territory.
So we agreed to task experts
in both our countries
to work on specific understandings
about what's off limits
and to follow up on specific cases
that originate in other countries,
in either of our countries.
- [Narrator] So what can individuals and companies
do now to better protect themselves?
Goldstein said CISA is focused
on helping ensure that organizations understand basic steps
that they need to adopt to protect themselves.
Like running up-to-date software
and using multi-factor authentication.
He hopes the intrusions at Colonial Pipeline
and JBS serve as a wake-up call
for organizations across the country.
- The first barrier to increasing adoption
of cybersecurity best practices
is ensuring awareness among business management
and business leaders
to make sure that when companies
are deciding where to invest
and which risks to invest in driving down,
cybersecurity and the risk of ransomware attacks
is seen as a top-priority risk.
- [Narrator] Robinson said that after they recovered
from the ransomware attack on the library,
they implemented many security changes
to prevent future attacks,
like reworking their server backup system.
- We made sure that our catalog was on a firewall.
We have a product called Silence that's running
that's watching for not just known viruses
but unusual activity.
- [Narrator] Following the ransomware attack
on Colonial Pipeline,
President Biden said ransomware
was a growing problem in need of a global response.
As part of that response,
TSA released security directives
requiring pipeline operators
to provide notification
when they are targets or victims of cyber attacks,
to appoint a cybersecurity coordinator,
and to review their current activities.
And some lawmakers and former government officials say
that the federal government
should now expand mandatory cybersecurity requirements
across critical infrastructure sectors.
Additionally, some lawmakers have said they may be open
to considering legislation
that could make ransom payments illegal in some cases
or require companies to disclose
when they make a ransom payment to hackers.
FBI officials said the techniques they used
to recover some of Colonial funds
can be used in future cases,
including when hackers attempt
to transfer cryptocurrency
through unfriendly overseas jurisdictions.
- We are looking at this as a whole
of solutions effort
in which we need to focus on the groups themselves,
their infrastructures, and then shoring up defenses
across victim companies
and by focusing deeply on each of those areas,
we'll be able to drive down this risk over time.
(dramatic music)