A Rundown of the Biggest Cybersecurity Incidents of 2016

The Hollywood Presbyterian Medical Center

In early February, the Hollywood Presbyterian Medical Center was hit by a ransomware attack that knocked the hospital’s network offline. The attack heavily affected the facility's daily operations, as urgent scans, lab work, pharmaceutical needs, and documentation couldn't be processed. The systems were down for more than a week before the hospital reportedly paid the ransom of 40 Bitcoins, which amounted to $17,000.

MedStar Health

MedStar is one of America’s leading healthcare providers with a network of ten hospitals and 250 outpatient centers under its name—many of which were affected as ransomware attackers paralyzed their systems in late March. The organization acted quickly and took down all system interfaces to prevent the malware from spreading. The ransom was set at 45 bitcoins (around $19,000) with a ten-day deadline, but MedStar was reportedly able to bring their systems back online without paying.

The University of Calgary

In late May, a ransomware attack crippled multiple systems connected to the university’s network. While the staff was able to isolate some of the affected machines so that most systems were operational, the university decided that it was the best course of action to pay the $20,000 demanded by the attackers because of the risk to critical data and valuable research.

The business of Ransomware-as-a-Service

Creators earn money by taking a cut from the distributors of their ransomware, and as RaaS becomes cheaper and easier to find, it has become more mainstream. By enlisting a large network of distributors, ransomware is spread to more victims, which equates to a bigger potential for profit for its creators. One example is the Shark ransomware that was hosted on a public WordPress site, and not the usual anonymous network typically favored by other ransomware authors. Shark also had a guide on customization, distributor tips on how much ransom to demand, and other useful documents. Creators took 20% of the ransom collected while distributors got 80%.

Menomonee Falls

Menomonee Falls is a small village in Waukesha County, Wisconsin with a population of around 35,000. This year marked the first time that the local authorities had to deal with ransomware attacks on businesses operating in their jurisdiction. In October, a local woodworking company was hit by a ransomware attack that crippled their computer systems and demanded eight bitcoin.

SFMTA ticket system hacked

During Thanksgiving weekend, one of the busiest weekends of the year, San Francisco commuters got to ride the train for free as ransomware attackers infiltrated the SFMTA ticketing systems, which the organization was forced to take offline. The attackers claimed to have compromised 2,000 computer systems and stolen 30 gigabytes of important data. The attackers demanded a ransom of 100 bitcoins (around $73,000), but SFTA officials “never considered paying it”. Their IT team restored the systems over the weekend, and normal operations resumed on Sunday.

The first Mac-targeting ransomware

The ransomware dubbed KeRanger (detected by Trend Micro as RANSOM_KERANGER.A) was specifically designed to target Mac OS X machines. It was discovered in early March when users found malicious files in Transmissions 2.90, a popular BitTorrent client. Estimated to have affected 6,500 victims, the overall impact was relatively small compared to other ransomware. The concern comes from it being the first functional Mac ransomware, an indicator that attackers are honing their tools to target Mac users specifically.

Leoni AG

Leoni AG is a cable and harnessing manufacturing company based in Germany. In August of this year, the CFO of the company’s factory in Romania was tricked into transferring €40 million to an unknown bank account. The scammer spoofed an email to look like it was sent by a top executive, and crafted the request to comply with the internal policies of Leoni. Because the request seemed authentic enough, the CFO wired to money.

Bangladesh Bank

In one of the biggest bank heists in history, hackers acquired the SWIFT credentials of an operator at Bangladesh Bank and also installed multiple types of malware in their system. In early February, they began to send requests from Bangladesh Bank to the Federal Reserve Bank of New York to transfer funds to accounts in Sri Lanka and the Philippines. They timed their request to coincide with the weekend—a tactic to avoid being discovered. The hackers also tampered with the bank’s printing system so that the SWIFT acknowledgment receipts which registered the fraudulent transactions wouldn’t be printed and tracked by employees.

SWIFT victim organization

Bangladesh Bank was the highest profile victim of SWIFT fraudsters, but it was also disclosed that Ecuadorean bank Banco del Austro fell victim to a SWIFT attack in 2015. The bank lost $12 million when hackers gained access to the codes the bank used to move money via SWIFT. The stolen cash was moved to accounts in Hong Kong, Dubai, New York and Los Angeles. Reports also detailed a failed attempt in late 2015 to steal money from Vietnam's Tien Phong Bank.

Active attacks

The patches come regularly, with some months delivering more critical fixes than others. There were multiple incidents that involved exploiting Windows vulnerabilities, with one recently causing some disagreements. In November, Microsoft released a patch for a zero-day vulnerability that was previously announced by Google. The exploit abused a flaw in the win32k system that allowed attackers to escape from Window’s security sandbox. The Google team reported that it was being actively exploited by malware attackers, while Microsoft disagreed with the seriousness of the bug and the speed of their announcement.  

Brian Krebs

The security researcher published a detailed blog on a DDoS-for-hire group and found himself fighting off 620 Gbps of malicious traffic—the biggest DDoS attack recorded at the time. The attack shut down his site for days, but went back online after receiving help from Google’s Project Shield. This was the beginning of a wave of huge DDoS attacks.  

Dyn

A massive DDoS attack on DNS provider Dyn affected major websites and millions of users across the East Coast. The attack reportedly reached up to 1.2 Tbps, affecting sites like Twitter, Reddit, Netflix, Spotify and more. Initial analysis pointed to an estimated 100,000 compromised Internet of Things devices, which were turned into bots by the Mirai malware. 

Russian banks

Prolonged DDoS attacks hit five Russian banks in early November, though online client services went on as usual. The attacks lasted over two days and reportedly involved at least 24,000 computers across 30 countries. 

Malware in Ukraine energy firms

Three regional electric power distribution companies in Ukraine experienced unscheduled power outages caused by a coordinated cyberattack. It lasted an estimated 3 hours and impacted around 250,000 customers. The hackers accessed the SCADA networks through hijacked VPNs, and from there they were able to control the power grid. They didn’t just cut power to the customers, but also made sure to leave operators powerless too. Reports detailed that the companies had been infected with the BlackEnergy malware, which played a role in the attack but was likely not the only cause of the outage. The KillDisk module within BlackEnergy was executed at the end of the attack, wiping some systems and rendering others inoperable. This situation shows the increasing sophistication of attacks on industrial control systems—BlackEnergy is evolving to work in multiple areas and increasing its effectivity.

More than a billion Yahoo users breached

Last September, Yahoo confirmed a massive breach that left 500 million users compromised. The breach included names, email addresses, phone numbers, and encrypted passwords. The company announced that the data came from a 2014 intrusion into its systems by “state sponsored actors”. This confirmation came in the middle of Verizon Communications' acquisition of Yahoo for $4.8 billion, possibly impacting the deal.

On December 14, only two months after the 2014 breach was reported, news came of an even larger breach. The company disclosed that more than one billion users were compromised, making it the biggest breach on record. Yahoo clarified that this was a distinct breach from the September announcement, and that it likely came from a 2013 attack.

DNC leak

A collection of over 19,000 emails from the DNC, the governing body of the Democratic Party of the United States, was leaked and published by WikiLeaks. This resulted in the resignation of DNC chair Debbie Wasserman Schultz as well as other prominent members of the committee. Reports also speculated that the leak may have influenced the outcome of the national elections.  

Apple zero-day vulnerabilities

Three zero-day vulnerabilities were identified and dubbed “Trident”. The chain of vulnerabilities could be leveraged to spy on the individual, collecting information from messaging apps, email, social media, and others. Trident was discovered when an activist in the UAE received text messages he identified as suspicious. He reported it to Citizen Lab, a research facility based in Toronto which worked with mobile security firm Lookout to gather more information about the vulnerabilities. Apple quickly issued a patch and widely urged customers to update to the latest version of the OS.

Adobe Flash vulnerabilities

The number of Flash vulnerabilities discovered in 2016 was comparable with previous years, however, there were still several serious zero-days found and exploited. In late October, espionage group Pawn Storm ramped up its global spear-phishing campaign using a Flash zero-day even after a patch was issued. Both Adobe and Microsoft provided fixes, but the hackers still expanded the campaign. No doubt they were trying to get as many victims as possible before users updated their software.