Hackers Breached Colonial Pipeline Using Compromised VPN Password

The ransomware cartel that masterminded the Colonial Pipeline attack early last month crippled the pipeline operator's network using a compromised virtual private network (VPN) account password, the latest investigation into the incident has revealed.

The development, which was reported by Bloomberg on Friday, involved gaining an initial foothold into the networks as early as April 29 through the VPN account, which allowed employees to access the company's networks remotely.

The VPN login was unused but active at the time of the attack, the report said, adding the password has since been discovered inside a batch of leaked passwords on the dark web, suggesting that an employee of the company may have reused the same password on another account that was previously breached.

It's, however, unclear how the password was obtained, Charles Carmakal, senior vice president at the cybersecurity firm Mandiant, was quoted as saying to the publication. The FireEye-owned subsidiary is currently assisting Colonial Pipeline with the incident response efforts following a ransomware attack on May 7 that led to the company halting its operations for nearly a week.

DarkSide, the cybercrime syndicate behind the attack, has since disbanded, but not before stealing nearly 100 gigabytes of data from Colonial Pipeline in the act of double extortion, forcing the company to pay a $4.4 million ransom shortly after the hack and avoid disclosure of sensitive information. The gang is estimated to have made away with nearly $90 million during the nine months of its operations.

The Colonial Pipeline incident has also prompted the U.S. Transportation Security Administration to issue a security directive on May 28 requiring pipeline operators to report cyberattacks to the Cybersecurity and Infrastructure Security Agency (CISA) within 12 hours, in addition to mandating facilities to submit a vulnerability assessment identifying any gaps in their existing practices within 30 days.

The development comes amid an explosion of ransomware attacks in recent months, including that of Brazilian meat processing company JBS last week by Russia-linked REvil group, underscoring a threat to critical infrastructure and introducing a new point of failure that has had a severe impact on consumer supply chains and day-to-day operations, leading to fuel shortages and delays in emergency health procedures.

As the ransom demands have ballooned drastically, inflating from thousands to millions of dollars, so have the attacks on high-profile victims, with companies in energy, education, healthcare, and food sectors increasingly becoming prime targets, in turn fueling a vicious cycle that enables cybercriminals to seek the largest payouts possible.

The profitable business model of double extortion — i.e., combining data exfiltration and ransomware threats — have also resulted in attackers expanding on the technique to what's called triple extortion, wherein payments are demanded from customers, partners, and other third-parties related to the initial breach to demand even more money for their crimes.

Worryingly, this trend of paying off criminal actors has also set off mounting concerns that it could establish a dangerous precedent, further emboldening attackers to single out critical infrastructure and put them at risk.

REvil (aka Sodinokibi), for its part, has begun incorporating a new tactic into its ransomware-as-a-service (RaaS) playbook that includes staging distributed denial-of-service (DDoS) attacks and making voice calls to the victim's business partners and the media, "aimed at applying further pressure on the victim's company to meet ransom demands within the designated time frame," researchers from Check Point disclosed last month.

"By combining file encryption, data theft, and DDoS attacks, cybercriminals have essentially hit a ransomware trifecta designed to increase the possibility of payment," network security firm NetScout said.

The disruptive power of the ransomware pandemic has also set in motion a series of actions, what with the U.S. Federal Bureau of Investigation (FBI) making the longstanding problem a "top priority." The Justice Department said it's elevating investigations of ransomware attacks to a similar priority as terrorism, according to a report from Reuters last week.

Stating that the FBI is looking at ways to disrupt the criminal ecosystem that supports the ransomware industry, Director Christopher Wray told the Wall Street Journal that the agency is investigating nearly 100 different types of ransomware, most of them traced backed to Russia, while comparing the national security threat to the challenge posed by the September 11, 2001 terrorist attacks.

Found this article interesting? Follow THN on Facebook, Twitter  and LinkedIn to read more exclusive content we post.