The ransom in excess of $7.5 Million is only one of many remediation issues Argentina’s largest ISP has to address, with it appearing that the entire network was compromised in the process.
It appears that Telecom Argentina definitely wasn’t prepared for this type of attack. REvil ransomware has been around since mid-2019 and the tactics used by this cybercriminal group are relatively well-known. According to reports from ZD Net, Telecom Argentina was running a Citrix VPN with a known security vulnerability whose patch had been issued months ago. Additionally, internal sources stated employees were being warned not to “open emails containing archive files”, indicating the potential use of phishing as another possible attack vector.
Once compromised access was achieved, reports indicate that the REvil gang were able to gain control over an Active Directory account with Domain Admin rights and used this account to spread their ransomware installer to the massive number of infected endpoints.
Seeing as REvil is known for also stealing victim data – either threating to release it to extort the ransom or auction it off to the highest bidder – it’s likely that sensitive Telecom Argentina data has already been exfiltrated, although REvil hasn’t taken any actions to confirm this is the case.
This ransomware attack demonstrates how the planning of a defensive strategy against a ransomware attack is the only strategy warranted. Sure, you can recover your data afterwards, but the damage is done and it will take months for Telecom Argentina to truly believe they are back to a known-secure state.
Lessons to be learned from this attack include:
- Patch everything, immediately. Adding in vulnerability scanning would give you a leg up on just simple patch management.
- Monitor/manage use of privileged accounts, restricting who can access them, from where, etc.
Include your users into the security strategy by putting them through continual Security Awareness Training that keeps phishing emails from becoming a viable initial attack vector for ransomware or any other cyberattack.
Here's how it works:
