Ransomware Cyber Attack Forced the Largest U.S. Fuel Pipeline to Shut Down

Colonial Pipeline, which carries 45% of the fuel consumed
on the U.S. East Coast, on Saturday said it halted operations due
to a ransomware attack, once again demonstrating^[1] how infrastructure is
vulnerable to cyberattacks.

“On May 7, the Colonial Pipeline Company learned it was the
victim of a cybersecurity attack,” the company said^[2]
in a statement posted on its website. “We have since determined
that this incident involves ransomware. In response, we proactively
took certain systems offline to contain the threat, which has
temporarily halted all pipeline operations, and affected some of
our IT systems.”

Colonial Pipeline is the largest refined products pipeline in
the U.S., a 5,500 mile (8,851 km) system involved in transporting
over 100 million gallons from the Texas city of Houston to New York
Harbor.

Cybersecurity firm FireEye’s Mandiant incident response division
is said to be assisting with the investigation, according to
reports from Bloomberg^[3]
and The Wall Street Journal^[4], with the attack linked
to a ransomware strain called DarkSide^[5].

“We are engaged with Colonial and our interagency partners
regarding the situation,” the U.S. Cybersecurity and Infrastructure
Security Agency (CISA) said^[6]. “This underscores the
threat that ransomware poses to organizations regardless of size or
sector. We encourage every organization to take action to
strengthen their cybersecurity posture to reduce their exposure to
these types of threats.”

Darkside ransom note

An analysis of the ransomware published^[7]
by Cybereason earlier in April 2021 reveals that DarkSide has a
pattern of being used against targets in English-speaking
countries, while avoiding entities located in former Soviet Bloc
nations.

The operators behind the ransomware also recently switched to an
affiliate program^[8]
in March, wherein threat actors are recruited to spread the malware
by breaching corporate network victims, while the core developers
take charge of maintaining the malware and payment
infrastructure.

DarkSide, which commenced operations in August 2020, has
published stolen data from more than 40 victims to date. It’s not
immediately clear how much money the attackers demanded or whether
Colonial Pipeline has paid. A separate report^[9]
from Bloomberg alleged that the cybercriminals behind the attack
stole 100GB of data from its network.

Rising Threat of Ransomware

The latest cyber attack comes as a coalition of government and
tech firms in the private sector, called the Ransomware Task Force,
released a list of 48 recommendations^[10] to detect and disrupt
the rising ransomware threat, in addition to helping organizations
prepare and respond to such attacks more effectively.

Potentially damaging intrusions targeting utilities and critical
infrastructure have witnessed a surge in recent years, fueled in
part by ransomware attacks that have increasingly jumped on the
double extortion^[11] bandwagon^[12] to not only encrypt the
victim’s data, but exfiltrate the data beforehand and threaten to
make it public if the ransom demand is not paid.

Based on data gathered by Check Point and shared with The Hacker
News, cyberattacks targeting American utilities jumped by 50% on
average per week, from 171 at the start of March to 260 towards the
end of April. What’s more, over the last nine months, the monthly
number of ransomware attacks in the U.S. nearly tripled to 300.

“Furthermore, in recent weeks an average of 1 in every 88
Utilities organization in the U.S. suffered from an attempted
Ransomware attack, up by 34% compared to the average from the
beginning of 2021,” the American-Israeli cybersecurity firm
said.

In February 2020, CISA issued an alert^[13] warning of increasing
ransomware infections impacting pipeline operations following an
attack that hit an unnamed natural gas compression facility in the
country, causing the company to shut down its pipeline asset for
about two days.

Securing pipeline infrastructure has been an area of focus for
the Department of Homeland Security, which in 2018 assigned CISA to
oversee what’s called the Pipeline Cybersecurity Initiative
(PCI^[14]) that aims to identify and address^[15] emerging threats and
implement security measures to protect more than 2.7 million miles
of pipelines responsible for transporting oil and natural gas in
the U.S.

The agency’s National Risk Management Center (NRMC) has also
published a Pipeline Cybersecurity Resources
Library^[16] in February 2021 to
“provide pipeline facilities, companies, and stakeholders with a
set of free, voluntary resources to strengthen their cybersecurity
posture.”