Pierluigi Paganini March 08, 2020

The City of Durham, North Carolina, was the last victim in order of time of the infamous Ryuk ransomware that infected its systems.

The City of Durham, North Carolina was forced to shut down its network after its systems have been infected with the Ryuk Ransomware during the weekend.

According to the local media, the City of Durham was hit with a phishing attack aimed at delivering the Ryuk Ransomware on the victims’ systems.

“According to the SBI, the ransomware, named Ryuk, was started by a Russian hacker group and finds its way into a network once someone opens a malicious email attachment. Once it’s inside, Ryuk can spread across network servers through file shares to individual computers,”  reads a post published by SBI.

“IT officials are working to get the communication systems back online.”

“While it is an inconvenience for them to be disconnected, it’s safer for the state as a whole due to the critical nature of this network for all of North Carolina’s Law Enforcement,” reads the security breach notification sent by email.

To mitigate the threat and prevent it from spreading inside the city network the City of Durham has disabled all access into the DCI Network for the Durham Police Department with the result that 911 call center was shut down.

“To prevent the attack from spreading throughout their network, the City of Durham has “temporarily disabled all access into the DCI Network for the Durham Police Department, the Durham Sheriff’s Office and their communications center”. reported BleepingComputer.

“This has caused the city’s 911 call center to shut down and for the Durham Fire Department to lose phone service. 911 calls, though, are being answered.”

At the time it is not clear if the attackers have stolen any data from the City of Durham’s systems.

A few days ago EVRAZ, one of the world’s largest multinational vertically integrated steel making and mining companies, has been hit by the Ryuk ransomware.

The list of the victims of the Ryuk ransomware is very long and includes the US government contractor Electronic Warfare Associates (EWA), US railroad company Railworks, Croatian petrol station chain INA Group, and parts manufacturer Visser Precision.

Pierluigi Paganini

(SecurityAffairs – hacking, Ryuk ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]