A ransomware attack last weekend struck the network of the Canadian territory Nunavut, severely impeding a bevy of government services that rely on access to systems and electronic files.
The attack took place on Saturday afternoon, encrypting files on government servers and workstations and crippling email and other internet-based communications. The only service to be unaffected is the Qulliq Energy Corporation, Nunavut's only power utility.
With an estimated population that's approaching 40,000, Nunavut is Canada's northernmost territory, which split off from the Northwest Territories in 1999. Many of its inhabitants are Inuit.
"I want to assure Nunavummiut that we are working non-stop to resolve this issue," said Nunavut Premier Joe Savikataaq in a government press release. "Essential services will not be impacted and the GN will continue to operate while we work through this issue. There will likely be some delays as we get back online, and I thank everyone for their patience and understanding."
In an attempt to mitigate the incident, the territory is prioritizing the restoration of data to key services related to health, family services, education, justice and finance, the press release continues. Government officials expect that most files will ultimately be restored, thanks to their use of back-up files. While services continue to operate, some are running contingency procedures and conducting business manually, resulting in significant delays.
An FAQ page published on Nunavut's official government website offered updates on the statuses of its departments.
For instance, Department of Health workers are currently relying on a paper-based system, while the territory's MediTech health care software system remains inoperational. Health care facilities continue to operate, and patients scheduled for visits can keep their appointments, though they are asked to bring their health care cards and medications. Telehealth services, however are down and must be rescheduled.
Additionally, the Finance Department may be delayed in sending government employees and vendors their scheduled paychecks. Medical or duty travel payments and reimbursements are also impacted. Distribution of driver's licenses and ID cards -- a responsibility of the Department of Economic Development and Transportation (EDT) -- is also impacted.
Networked phone services in the capital of Iqaluit are functional, but using direct dial only.
"Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm," the states the ransom note, which was obtained by the Canadian Broadcasting Corporation (CBC). The note instructs the victim to install the Tor browser and visit a link to a payment site. The attackers warn that the link expires in 21 days, at which point the decryption key will be deleted.
Brett Callow, company spokesperson at cybersecurity company Emsisoft, told SC Media in emailed comments that the ransomware note matches that of a ransomware called DoppelPaymer, which is often distributed via the Dridex banking trojan. Victims are often infected with Dridex when they open a phishing email attachment, he added.
In the Nov. 4 press release, Nunavut officials said they responded to the attack by "isolating the network, notifying cybersecurity experts and working with our internet software providers."
"It is difficult to estimate recovery timelines at this early stage," the release continues.
"Ransomware attacks can have a much larger impact than temporarily denying access to systems in exchange for payment. The demanded ransom amounts often pale in comparison to the collateral damage and downtime costs they cause," said Justin Des Lauriers, technical project manager at Exabeam, in emailed comments. His colleague, Barry Shteiman, VP of research and innovation, added that "for cybersecurity teams to detect ransomware early enough in the ransomware lifecycle to stop it, they need to understand the business models used by ransomware network operators, the kill chain of a ransomware attack and how to detect and disrupt ransomware in corporate environments. Armed with this information, analysts should be able to react faster in the event their organization is hit with a ransomware infection."
