Two schools, two ransomware attack and two different outcomes.
The Allegheny Intermediate Unit school system was able to fend off a recent ransomware attack using back up files, meanwhile the University of Maastricht just disclosed it paid 30 bitcoins to regain control of its encrypted computer network.
Allegheny Intermediate Unit (AIU), a regional public education agency that is part of Pennsylvania's public education system, reported that portions of its network recently were hit with ransomware with the attackers demanding a ransom payment to restore the files. The school system refused to pay the unnamed amount.
AIU interim director Rosanne Javorsky hired an outside security firm to lock down and restore the system using back up files.
“The AIU had backup versions of the most critical information and was able to restore access to the vast majority of the impacted files without engaging or paying the intruder. To ensure the integrity of our systems and avoid similar incidents in the future, we are reviewing our policies and procedures and continuing to enhance the security of our information systems,” she said.
AIU does not believe any information was removed from its system.
However, The University of Maastricht, was unable to recover from a December 24, 2019 attack, Tripwire reported. The university hired the security firm Fox-IT which traced the attack to the cybergang TA505 who used a phishing email most likely containing a malicious document to download the malware. The school reported that the lost data contained student and scientific work and the overall damage to the institution was very severe.
IT News reported the school considered rebuilding its system from scratch, but in the end opted to pay the 30 bitcoin ransom, or about $300,000.
TA505 is a well-known threat group that has hit a variety of targets at least one U.S. based electrical company, a U.S. state government network and one of the 25 largest banks in the world. The gang is known for spreading Dridex, TrickBot and Locky malware, and is widely considered synonymous with the alleged Russian cybercriminal outfit Evil Corp.
