FBI warns of ransomware attacks targeting the food and agriculture sector

The FBI Cyber Division issued a Private Industry Notification (PIN) to warn of ransomware attacks targeting the Food and Agriculture sector disrupting its operations, causing financial loss and negatively impacting the overall food supply chain.

Small farms, large producers, processors and manufacturers, and markets and restaurants are particularly exposed to ransomware attacks.

“Cyber criminal threat actors exploit network vulnerabilities to exfiltrate data and encrypt systems in a sector that is increasingly reliant on smart technologies, industrial control systems, and internet-based automation systems. Food and agriculture businesses victimized by ransomware suffer significant financial loss resulting from ransom payments, loss of productivity, and remediation costs.” reads the FBI’s PIN. “Companies may also experience the loss of proprietary information and personally identifiable information (PII) and may suffer reputational damage resulting from a ransomware attack.”

The PIN provides a series of examples of ransomware attacks impacting food and agriculture sector businesses, such as an attack that took place in January 2021 against an identified US farm that resulted in losses of approximately $9 million due to the disruption of the farming operations. The attackers targeted the internal servers by gaining administrator-level access through compromised credentials.

In another incident that occurred in March 2021, a ransomware attack blocked the operations at a US beverage company, while in a November 2020 attack on a US-based international food and agriculture business threat actors requested the payment of a gigantic $40 million ransom. The good news is in the latter attack the victims restored its backups.

The most clamorous attack against the sector was orchestrated by the REvil gang against JBS Foods disrupting its operations.

The FBI provided the following mitigations to protect against ransomware attacks:

Regularly back up data, air gap, and password protect backup copies offline. Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.Implement network segmentation.Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., hard drive, storage device, the cloud).Install updates/patch operating systems, software, and firmware as soon as they are released.Use multifactor authentication with strong pass phrases where possible.Use strong passwords and regularly change passwords to network systems and accounts, implementing the shortest acceptable timeframe for password changes. Avoid reusing passwords for multiple accounts.Disable unused remote access/RDP ports and monitor remote access/RDP logs.Require administrator credentials to install software.Audit user accounts with administrative privileges and configure access controls with least privilege in mind.Install and regularly update anti-virus and anti-malware software on all hosts.Only use secure networks and avoid using public Wi-Fi networks. Consider installing and using a VPN.Consider adding an email banner to messages coming from outside your organizations.Disable hyperlinks in received emails.Focus on cyber security awareness and training. Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities (i.e. ransomware and phishing scams).

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, FBI)

---