Hackers Breached Colonial Pipeline Using Compromised VPN Password

The ransomware cartel that masterminded the Colonial Pipeline attack^[1] early last month
crippled the pipeline operator’s network using a compromised
virtual private network (VPN) account password, the latest
investigation into the incident has revealed.

The development, which was reported^[2]
by Bloomberg on Friday, involved gaining an initial foothold into
the networks as early as April 29 through the VPN account, which
allowed employees to access the company’s networks remotely.

The VPN login was unused but active at the time of the attack,
the report said, adding the password has since been discovered
inside a batch of leaked passwords on the dark web, suggesting that
an employee of the company may have reused the same password on
another account that was previously breached.

It’s, however, unclear how the password was obtained, Charles
Carmakal, senior vice president at the cybersecurity firm Mandiant,
was quoted as saying to the publication. The FireEye-owned
subsidiary is currently assisting Colonial Pipeline with the
incident response efforts following a ransomware attack on May 7
that led to the company halting its operations for nearly a
week.

DarkSide, the cybercrime syndicate behind the attack, has since
disbanded^[3], but not before stealing
nearly 100 gigabytes of data from Colonial Pipeline in the act of
double extortion, forcing the company to pay a $4.4 million ransom^[4] shortly after the hack
and avoid disclosure of sensitive information. The gang is
estimated to have made away with nearly $90 million during the nine
months of its operations.

The Colonial Pipeline incident has also prompted the U.S.
Transportation Security Administration to issue a security directive^[5]
on May 28 requiring pipeline operators to report cyberattacks to
the Cybersecurity and Infrastructure Security Agency (CISA) within
12 hours, in addition to mandating facilities to submit a
vulnerability assessment identifying any gaps in their existing
practices within 30 days.

The development comes amid an explosion of ransomware attacks^[6] in recent months,
including that of Brazilian meat processing company JBS^[7] last week by
Russia-linked REvil group, underscoring a threat to critical
infrastructure and introducing a new point of failure that has had
a severe impact on consumer supply chains and day-to-day
operations, leading to fuel shortages and delays in emergency health
procedures^[8].

As the ransom demands have ballooned drastically, inflating from
thousands to millions of dollars, so have the attacks on
high-profile victims, with companies in energy, education,
healthcare, and food sectors increasingly becoming prime targets,
in turn fueling a vicious cycle that enables cybercriminals to seek
the largest payouts possible.

The profitable business model of double extortion — i.e.,
combining data exfiltration and ransomware threats — have also
resulted in attackers expanding on the technique to what’s called
triple extortion^[9], wherein payments are
demanded from customers, partners, and other third-parties related
to the initial breach to demand even more money for their
crimes.

Worryingly, this trend of paying off criminal actors has also
set off mounting concerns that it could establish a dangerous
precedent, further emboldening attackers to single out critical
infrastructure and put them at risk.

REvil (aka Sodinokibi), for its part, has begun incorporating a
new tactic into its ransomware-as-a-service (RaaS) playbook that
includes staging distributed denial-of-service (DDoS) attacks and
making voice calls to the victim’s business partners and the media,
“aimed at applying further pressure on the victim’s company to meet
ransom demands within the designated time frame,” researchers from
Check Point disclosed last month.

“By combining file encryption, data theft, and DDoS attacks,
cybercriminals have essentially hit a ransomware trifecta designed
to increase the possibility of payment,” network security firm
NetScout said^[10].

The disruptive power of the ransomware pandemic has also set in
motion a series of actions, what with the U.S. Federal Bureau of
Investigation (FBI) making the longstanding problem a “top priority^[11].” The Justice
Department said it’s elevating investigations of ransomware attacks
to a similar priority as terrorism, according to a report^[12] from Reuters last
week.

Stating that the FBI is looking at ways to disrupt the criminal
ecosystem that supports the ransomware industry, Director
Christopher Wray told^[13] the Wall Street Journal
that the agency is investigating nearly 100 different types of
ransomware, most of them traced backed to Russia, while comparing
the national security threat to the challenge posed by the
September 11, 2001 terrorist attacks.