Royal Ransomware Claims Attack on Intrado Telecom Provider - Binary Defense

Threat Watch

Threat Watch Royal Ransomware Claims Attack on Intrado Telecom Provider

Royal Ransomware Claims Attack on Intrado Telecom Provider

The Royal Ransomware gang claimed responsibility for a ransomware attack against telecommunications company Intrado on Tuesday. While Intrado has yet to share any information regarding this incident, BleepingComputer reports the attack started early in December and the initial ransom demand was $60 million. Royal is believed to be a rebrand of Conti ransomware after the group split following internal disagreements over Russia’s invasion of Ukraine. Although the ransomware gang has not yet leaked all of the files allegedly exfiltrated from Intrado’s network, they did share a 52.8 MB archive containing scans of passports, business documents, and driver’s licenses as proof of the breach. The date of the initial breach coincides with a widespread outage that impacted all of Intrado’s services, including Unified Communication Services, Healthcare, and Unified Communications as a Service (UCaaS). However, while Intrado has restored most of the affected services, the company was still working on fully restoring services to healthcare providers one week ago. Intrado also provides telecommunications services for 911 calls, but there was no reported disruption of 911 services due to the breach.

ANALYST NOTES

To protect against ransomware attacks, organizations should:

· Regularly back up data, air gap backups, and password-protect backup copies offline.

· Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.

· Implement network segmentation.

· Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location

· Install updates/patches operating systems, software, and firmware as soon as practical after they are released.

· Implement monitoring of security events on employee workstations and servers, with a 24/7 Security Operations Center to detect threats and respond quickly.

· Use multi-factor authentication where possible.

· Use strong passwords and regularly change passwords to network systems and accounts, implementing the shortest acceptable timeframe for password changes.

· Avoid reusing passwords for multiple accounts.

· Focus on cyber security awareness and training.

· Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.

Source: https://www.bleepingcomputer.com/news/security/royal-ransomware-claims-attack-on-intrado-telecom-provider/