Global campaign against ransomware puts US and European officials on alert

Washington
CNN
—

A new global ransomware campaign has claimed at least 3,800 victims, including hundreds in the United States, according to crowdsourced data reviewed by CNN, prompting warnings from European and American cybersecurity officials.

However, only four of those victims have paid ransoms so far, according to Ransomwhere, a platform created by cybersecurity researchers to track ransomware attacks. And the extent to which the ransomware – which encrypts computers and demands payment – disrupted the operations of victim organizations, if any, is unclear.

Attackers are exploiting a 2-year-old vulnerability in widely used software made by California-based cloud computing giant VMWare.

Ransomwhere’s tally of 3,800 victims covers IP addresses, the unique numbers that identify computers online. The number of affected organizations could be less than 3,800 if multiple IP addresses correspond to the same organization.

Reuters first reported on the Ransomwhere data.

Despite arrests and seizures of hacking infrastructure, ransomware remains one of the top digital threats to the operation of critical infrastructure like hospitals and factories. And the problem is compounded by poor security practices.

The latest outbreak was so widespread because victim organizations left vulnerable software exposed directly to the public internet, making it easier for cybercriminals to gain access.

French and Italian government agencies warned of attacks late last week and over the weekend, and now US cybersecurity officials say they are on call to help American victims.

The US Federal Cyber ​​and Infrastructure Security Agency is “working with our public and private sector partners to assess the impacts of these reported incidents and provide assistance as needed,” a CISA spokesperson told CNN.