FBI, CISA: Ransomware attack risk increases on holidays, weekends

The FBI and CISA urged organizations not to let down their defenses against ransomware attacks during weekends or holidays in a joint cybersecurity advisory issued earlier today.

The two federal agencies said they "observed an increase in highly impactful ransomware attacks occurring on holidays and weekends—when offices are normally closed—in the United States, as recently as the Fourth of July holiday in 2021."

Attacks on high-profile US entities carried out during weekends

While the FBI and CISA do not have any info regarding potential attacks within upcoming holidays and weekends, they gave as examples the attacks on the networks of Colonial Pipeline, JBS, and Kaseya.

JBS, the world's largest beef producer, paid an $11 million ransom to the REvil ransomware gang after a Memorial Day weekend attack.

Colonial Pipeline also paid a $4.4 million ransom to the DarkSide group (the Department of Justice later seized a DarkSide cryptocurrency wallet, recovering most of the paid ransom) after being attack right before the Mother's Day weekend.

One month later, a large-scale REvil ransomware attack also hit dozens of Kaseya customers and up to 1,500 other downstream businesses over the Fourth of July weekend.

As shared by the FBI and CISA in their advisory:

In May 2021, leading into Mother's Day weekend, malicious cyber actors deployed DarkSide ransomware against the IT network of a U.S.-based critical infrastructure entity in the Energy Sector, resulting in a week-long suspension of operations. After DarkSide actors gained access to the victim's network, they deployed ransomware to encrypt victim data and—as a secondary form of extortion—exfiltrated the data before threatening to publish it to further pressure victims into paying the ransom demand. In May 2021, over the Memorial Day weekend, a critical infrastructure entity in the Food and Agricultural Sector suffered a Sodinokibi/REvil ransomware attack affecting US and Australian meat production facilities, resulting in a complete production stoppage. In July 2021, during the Fourth of July holiday weekend, Sodinokibi/REvil ransomware actors attacked a U.S.-based critical infrastructure entity in the IT Sector and implementations of their remote monitoring and management tool, affecting hundreds of organizations—including multiple managed service providers and their customers.

CISA can help defend against ransomware attacks

According to the joint advisory issued today, the following ransomware gangs are behind the most frequently reported attacks to the FBI over the last month: Conti, PYSA, LockBit, RansomEXX/Defray777, Zeppelin, Crysis/Dharma/Phobos.

"Although cyber criminals use a variety of techniques to infect victims with ransomware, the two most prevalent initial access vectors are phishing and brute forcing unsecured remote desktop protocol (RDP) endpoints," the agencies said.

"CISA offers a range of no-cost cyber hygiene services—including vulnerability scanning and ransomware readiness assessments—to help critical infrastructure organizations assess, identify, and reduce their exposure to cyber threats.

"By taking advantage of these services, organizations of any size will receive recommendations on ways to reduce their risk and mitigate attack vectors."

To block their attacks, organizations can also take several actions to protect their systems, including:

Making an offline backup of your data. Avoiding clicking on suspicious links. Securing and monitoring Remote Desktop Protocol endpoints. Updating OS and software. Using strong passwords. Using multi-factor authentication.

Incoming ransomware pandemic?

This joint advisory comes after US President Biden asked Russian President Putin in July to crack down on ransomware groups operating within Russia's borders.

Interpol also urged police agencies and industry partners to work together to prevent what looks like a future ransomware pandemic.

During a White House briefing, White House Press Secretary Jen Psaki also stated that the US would take action against Russian-based ransomware gangs if "the Russian government cannot or will not" do it.

One month earlier, Deputy National Security Advisor Anne Neuberger warned US businesses to take ransomware seriously following the Colonial Pipeline and JBS ransomware attacks.

The same month, G7 leaders also asked Russia to obstruct ransomware gangs launching attacks against entities from critical sectors worldwide, including US government agencies, from within Russia's borders.