Ransomware criminals are targeting US universities
As COVID-19 cases in the U.S. continue to climb, government and higher education leaders have been focused on doing what it takes to protect campus communities from the global pandemic.
But college and university leaders would be wise if they were just as vigilant about protecting their sensitive data from the cybercriminals who are becoming increasingly sophisticated about encrypting the colleges’ data and making the colleges pay a ransom to get it back.
One of the latest examples is a ransomware attack that struck the University of California, San Francisco on June 1. In that case, cybercriminals used the NetWalker malware to encrypt data on the servers of the university’s school of medicine. This malware targets corporate networks and encrypts the data it finds on the attacked devices. This means that the device owner cannot access data on the device until a ransom in cryptocurrency demanded by the criminal is paid. The criminal gang behind NetWalker has victimized dozens of organizations.
UCSF said that the attackers breached important data related to its medical school faculty’s research. It says its COVID-19 research was not affected.
Such ransomware attacks on universities have become common. In 2019 alone, 89 U.S. universities, colleges and school districts became victims of such attacks, followed by at least 30 in the first five months of 2020.
Along with the financial services industry, the education sector is one of the two most common targets of these attacks.
Attempts to extort
I research cybercrime and cybersecurity. I’ve learned that obtaining ransom payments from their victims is the biggest challenge most cybercriminals face, and that universities perform poorly on cybersecurity. Their vulnerabilities are becoming easier to exploit thanks to cryptocurrencies, such as bitcoin, which make it easier for cybercriminals to extract payments from their victims.
In the case of UCSF, university officials transferred 116.4 bitcoins — the equivalent of US$1.14 million — to the cryptocurrency wallet of the NetWalker gang and received the key to decrypt its own files in return.
NetWalker is sophisticated malware. To distribute ransomware, NetWalker creators rely on phishing and spam as well as other large-scale network infiltration such as hacking unsecured wireless devices connected to Wi-Fi networks.
After penetrating a network, it can render antivirus software useless.
The criminal group behind NetWalker mainly pursues high-value targets, such as the Champaign-Urbana Public Health District in Illinois and Michigan State University.
The creators of NetWalker are believed to collaborate with about 10 to 15 affiliates to distribute the malware. The affiliates, who are often less skillful criminal hackers than the creators of NetWalker, infiltrate a victim’s network and infect it with the ransomware. They later split any ransom money obtained with NetWalker’s creators.
Why higher ed is a target
In my view, colleges and universities have become attractive targets for cybercriminals because of their weak cybersecurity measures. Research shows that the education sector is the least-prepared to fend off cyberattacks. In a vulnerability test of U.K. universities, hackers obtained sensitive and valuable data in all cases within two hours.