Ransomware LockerGoga is making a big corporation miserable

Mexico's largest oil and gas corporation has been attacked by ransomware, presenting a cyber security disaster
Shade ransomware, the nightmare of 5 years ago is showing signs of returning

Norsk Hydro - one of the world's largest aluminum and renewable energy corporations based in Oslo, Norway, was forced to suspend most of its production lines and switch to manual operation. The part due to the network attack is said to be related to LockerGoga malicious code.

More specifically, the Norsk Hydro board representative recently officially announced that the company's IT team had begun to thoroughly analyze the case and found that it was in fact a A large-scale cyberattack called CET, targeting computer systems of many businesses in almost every business sector, with LockerGoga malware core. And Norsk Hydro has officially become a victim of this attack on the morning of Monday 18 March.

Ransomware LockerGoga is making a big corporation miserable Picture 1

LockerGoga is a relatively new ransomware, but the damage that this malicious code is no small at all and according to the forecast the victim list will continue to increase in the near future. LockerGoga attracted the attention of observers in mid-January when it was identified as the main agent in the attack on Altran Technologies, a professional technical consulting firm operating on a global level, with Based in Paris, France.

If using an Android phone, be careful: You may be being tracked without knowing

NorCERT warns companies about LockerGoga attacks

According to the Norwegian Government NRK media agency, the NorCERT network security agency issued a warning at a dangerous level to some of their partners on ransomware LockerGoga-based attacks, and Norsk Hydro was one of The latest victims of this malicious code.

The announcement from Norway's cybersecurity agency also said that the attack is related to Active Directory - used to authenticate and authorize all users and systems on the Windows domain network:

"According to NorCERT analysis, Norsk Hydro was faced with a LockerGoga attack, combined with another attack directed at Active Directory (AD)".

However, the experienced security researcher Håkon Bergsjø, head of NorCERT, left open the possibility of making sure that this was a targeted attack on Norsk's Active Directory servers. Hydro or not.

Ransomware LockerGoga is making a big corporation miserable Picture 2

Counter-Strike 1.6 features new Zero-Day, allowing malicious servers to hack gamers' computers

According to a related news, as part of the 18-minute press conference held on March 19, the Norwegian network security director declined to publicly disclose the true culprit behind the attack. Norsk Hydro. However, the company's system is infected with ransomware LockerGoga is a serious case and needs to be thoroughly analyzed.

Information on this malware is currently collected through collaboration at both national and international levels.

Norsk Hydro kept silent with questions about the details of the attack

In public statements, Norsk Hydro declined to comment on the nature of the attack but described the incident as "really serious", and said the company's team. "is working seriously to prevent and disable the attack", of course, combined with help from external security organizations.

Regarding the production situation, Norsk Hydro has sent reports to relevant agencies and informed interested people in an official status on Facebook that they "are moving to operate manually if possible".

Ransomware LockerGoga is making a big corporation miserable Picture 3

DDoS is ranked as the top threat for businesses in 2018

Eivind Kallevik, Norsk Hydro's CFO has officially confirmed the company's system was infected with ransomware LockerGoga during the press conference, and described the current situation as "quite serious." Besides, the CFO also added that the appropriate backup solutions have been applied, and the company's main strategy at the moment is to rely on backup solutions to restore data, helping the production line return to normal operation. often, at the same time avoid paying ransom for attackers.

According to CFO Eivind Kallevik, there was financial damage recorded, but not so seriously or could become "catastrophic" for the company. Some of Norsk Hydro's production facilities are currently in operation. In manual mode, which implies that instead of using machines, the number of employees working in a shift will be increased, and there will also be more shifts.

Currently, Norsk Hydro said it is still capable of handling all partner orders and delivering on time. However, future business agreements may be affected because the entire network of the company is currently inactive - the company's website displays 404 errors . Until the problem is solved. Decided, Norsk Hydro's employees were informed that the company would maintain production 24/7. The main priority at this time is to ensure safe operation, limit financial impact and implement appropriate measures to 'clean' the infected servers, and reinstall them from backups

Ransomware LockerGoga is making a big corporation miserable Picture 4

What can organizations do to protect themselves from cyber attacks?

There are no signs that factories outside Norsk Hydro's Norwegian territory are affected by this incident because they are all isolated from the company's global network.

Norsk Hydro's case is only part of a large-scale cyber-attack campaign, affecting operations in several business areas around the world.

Samuel Daniel

Update 23 May 2019

You should read it

May be interested

General guidelines for decoding ransomware
in this guide, tipsmake.com will try to help unfortunate readers infected with ransomware and encrypted files on the computer.
What is Ransomware Task Force (RTF)?
ransomware has become one of the top security threats in the past three years. the first ransomware strain and one of the worst nightmares in the history of global cybersecurity - wannacry - was discovered in may 2017.
[Infographic] 7 effective ways to protect businesses from Ransomware
how to protect your business from ransomware? join tipsmake.com to follow the article to find the answer.
How to decode ransomware InsaneCrypt (Everbe 1.0)
ransomware insanecrypt or everbe 1.0 is a ransomware family based on an open source project. this ransomware family is distributed through spam and hacked into remote desktop services, but this is not yet confirmed.
Why is Ransomware the perfect hack?
it is difficult to get an accurate number of cyber attacks, but the available data on ransomware give a poor picture.
Learn about Ransomware: 6 ransomware on computers
what is ransomware? are there any other ransomware? how does ransomware attack computers and demand ransom from users?
Detecting two unusual versions of ransomware, shows that the world of ransomware has become diversified
international cybersecurity researchers recently found two completely new types of ransomware that are quite strange. they carry very different and rarely recorded features, which are the alarm bells, showing that the world of ransomware has become diverse.
What is Fargo Ransomware? How to avoid?
ransomware is a major threat to the digital world, made even more so by cybercriminals coming up with various strategies. one way to solve the problem is to learn how these attacks work.
Warning: Quantum Ransomware is being rapidly deployed in lightning attacks
ransomware (ransomware) is probably not a new concept for most computer users. however, quantum ransomware is a term not everyone has heard of.
Ransomware can attack the CPU, not just the operating system: How to prevent it?
ransomware is a serious problem in its current state and is only going to get worse. any security programs and measures will be rendered useless when ransomware attacks the cpu.