2018 Atlanta cyberattack

Short description: Ransomware attack on the Atlanta government

‹ The template Infobox event is being considered for merging. ›

2018 Atlanta cyberattackDate| 22 March 2018[1]

|

Location| Atlanta, Georgia, United States
Type| Cyberattack
Theme| Ransomware encrypting files with $51,000 demand (via Bitcoin)
Cause|

* SamSam Ransomware

Outcome| Multiple municipal services down, including databases and wi-fi
Years' worth of data destroyed
City spends $2.7 million in recovering services

The city of Atlanta, Georgia was the subject of a massive cyberattack which began in March 2018.[2] The city recognized the attack on Thursday, March 22, 2018,[1][3] and publicly acknowledged it was a ransomware attack.

Due to Atlanta's national importance as a transportation and economic hub, the attack received wide attention[4] and was notable for both the extent and duration of the service outages caused. Many city services and programs were affected by the attack, including utility, parking, and court services.[5] City officials were forced to complete paper forms by hand.[6]

On November 26, a grand jury indicted two Iranian hackers, Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, for the attack. The Department of Justice alleged that Savandi and Mansouri are part of the SamSam group; that the SamSam group is based out of Iran; and that the pair created SamSam Ransomware, the malware used in the attack. There are no affiliations with the government of Iran.[7]

## Approach and attack

Leading up to the attack, the Atlanta government was criticized for a lack of spending on upgrading its IT infrastructure, leaving multiple vulnerabilities open to attack. In fact, a January 2018 audit found 1,500 to 2,000 vulnerabilities in the city's systems, and suggested that the number of vulnerabilities had grown so large that workers grew complacent.[8] The virus used to attack the city was the SamSam Ransomware, which differs from other ransomware in that it does not rely on phishing, but rather utilizes a brute-force attack to guess weak passwords until a match is found. It is known to target weaker IT infrastructures and servers.[9] The ransomware has prominently been behind attacks on medical and government organizations since its discovery in 2016, with previous attacks on targets ranging from small towns such as Farmington, New Mexico to the Colorado Department of Transportation and the Erie County Medical Center. It can also bypass antivirus software.[10] Despite no suspects being identified or indicted until November 2018, the SamSam hackers were described as "opportunistic".[11]

On March 22, at 5:40 AM, the Department of Atlanta Information Management first learned of outages on various internal and customer applications “including some applications customers use to pay bills or access court related information,” according to Richard Cox, the city's interim Chief of Operations. Soon afterward, the city shut down many of its digital services in an attempt to control the situation, including its court system database and the wi-fi at Hartsfield–Jackson Atlanta International Airport. The city eventually identified it as a ransomware attack.[3][1]

## Aftermath and recovery efforts

This hack was notable as it was the largest successful breach of security for a major American city by ransomware, potentially affecting up to 6 million people.[9][12] Following the attack, the city of Atlanta cooperated with the FBI, Department of Homeland Security, and Secret Service and hired security firms such as SecureWorks to investigate, and many government computers were advised to stay powered off until 5 days later.[6]

Though the city declared that there was little to no evidence that personal data had been compromised, later studies show that the breach was worse than originally estimated. In June 2018, it was estimated that a third of the software programs used by the city remained offline or partially disabled.[13] In addition, many legal documents and police dashcam video files were permanently deleted, though the police department was able to restore access to all its investigation files.[14] For a while, residents were forced to pay their bills and forms by paper.[6]

In response to this hack, Atlanta devoted $2.7 million to contractors in order to recover, but later estimated it would need $9.5 million.[13]

On November 26, 2018, the Department of Justice indicted two Iranian hackers for the attack, charging that Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri were part of the SamSam group and created SamSam Ransomware.[7]

## References

1. ↑ 1.0 1.1 1.2 "Atlanta, GA : Ransomware Cyberattack Information". https://www.atlantaga.gov/government/ransomware-cyberattack-information.
2. ↑ "Atlanta City Computer Network Remains Hobbled by Cyberattack". 23 March 2018. https://www.nytimes.com/aponline/2018/03/23/us/ap-us-atlanta-cyberattack.html.
3. ↑ 3.0 3.1 "Atlanta officials warn cyber attack may compromise sensitive data". https://www.myajc.com/news/local-govt--politics/atlanta-officials-warn-cyber-attack-may-compromise-sensitive-data/afZLYCO14WySObFATzKXRP/.
4. ↑ Blinder, Alan; Perlroth, Nicole (27 March 2018). "A Cyberattack Hobbles Atlanta, and Security Experts Shudder". The New York Times. https://www.nytimes.com/2018/03/27/us/cyberattack-atlanta-ransomware.html.
5. ↑ Kearney, Laila (March 23, 2018). "Atlanta ransomware attack throws city services into disarray". Reuters. https://www.reuters.com/article/usa-georgia-cyber/atlanta-ransomware-attack-throws-city-services-into-disarray-idUSL1N1R51V9.
6. ↑ 6.0 6.1 6.2 Hutcherson, Kimberly. "Six days after a ransomware cyberattack, Atlanta officials are filling out forms by hand". CNN. https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html.
7. ↑ 7.0 7.1 Perlroth, Nicole; Benner, Katie. "Iranians Accused in Cyberattacks, Including One That Hobbled Atlanta". https://www.nytimes.com/2018/11/28/us/politics/atlanta-cyberattack-iran.html.
8. ↑ "ISO/IEC 27001 ISMS Precertification Audit". City Auditor's Office. January 2018. http://www.atlaudit.org/isoiec-27001-isms-precertification-audit
january-2018.html.
9. ↑ 9.0 9.1 Freed, Benjamin (April 24, 2018). "Atlanta was not prepared to respond to a ransomware attack". https://statescoop.com/atlanta-was-not-prepared-to-respond-to-a-ransomware-attack.
10. ↑ Crowe, Jonathan (March 2018). "City of Atlanta Hit with SamSam Ransomware: 5 Key Things to Know". Barkly vs Malware. Barkly Protects, Inc.. https://blog.barkly.com/atlanta-ransomware-attack-2018-samsam.
11. ↑ "SamSam ransomware attacks have earned nearly $850,000". IDG. March 23, 2018. https://www.csoonline.com/article/3263693/security/samsam-ransomware-attacks-have-earned-nearly-850-000.html.
12. ↑ Poon, Linda (March 30, 2018). "Why Are Cities So Vulnerable to Cyber Attack?". https://www.citylab.com/life/2018/03/atlanta-city-hall-cyber-attack-ransomware-cesar-cerrudo/556703/.
13. ↑ 13.0 13.1 "Atlanta officials reveal worsening effects of cyber attack". Thomson Reuters. June 6, 2018. https://www.reuters.com/article/us-usa-cyber-atlanta-budget/atlanta-officials-reveal-worsening-effects-of-cyber-attack-idUSKCN1J231M?feedType=RSS&feedName=technologyNews.
14. ↑ Vaas, Lisa (June 8, 2018). "Atlanta ransomware attack destroyed years of police dashcam video". Sophos. https://nakedsecurity.sophos.com/2018/06/08/atlanta-ransomware-attack-destroyed-years-of-police-dashcam-video/.

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

|

Retrieved from "https://handwiki.org/wiki/index.php?title=2018_Atlanta_cyberattack&oldid=322723"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template