Case Study: Ransomware attack disrupts Australian university In February 2021, an Australian university’s technology environment was compromised as a result of a targeted ransomware cyber attack infiltrating the university’s infrastructure and applications. This led to the unprecedented decision by the university to shut down the network, ensuring the potential for further propagation was contained and critical learning and teaching could continue as scheduled. Following identification of the infiltration, the focus was on containment, investigation and core remediation and recovery. The university advised the ACSC that, based on independently verified analysis, there was no evidence to suggest any data breach had occurred. This incident highlights that compromising systems with malware can significantly disrupt an organisation’s services. The ACSC is aware that malicious cyber actors have used education sector networks to pivot to other networks, such as other universities, research centres and government agencies. Once on a network, cyber actors can easily exploit trusted relationships by using compromised accounts to spear phish individuals from other organisations of interest and maximise the spread of ransomware or gain access to sensitive information, such as intellectual property. Case Study: Largest fuel pipeline in the US shut down by a cyber attack On 7 May 2021, the administrative network of US fuel pipeline operator Colonial Pipeline was encrypted by an affiliate of the Darkside ransomware syndicate. The attack resulted in the company proactively shutting down its operations to contain the ransomware. While Colonial was able to manually restart sections of its pipeline in under 48 hours and was fully operational in six days, the shutdown had a substantial impact on the daily lives of many US communities along the east coast. Panic buying led to fuel shortages, and as a result, multiple US states declared a state of emergency and fuel prices rose considerably in the states most affected by the shutdown. Following the shutdown, the Darkside syndicate published an online statement describing itself as ‘apolitical,’ and emphasising its actions were financially motivated and not aimed at ‘creating problems for society.’ Colonial Pipeline later confirmed it had paid approximately $4.4 million (USD) ransom in bitcoin on the same day of the incident. Despite this, full automatic operations were not restored until six days later, with the media reporting that Darkside’s decryption tool had not been sufficient to completely restore Colonial Pipeline’s systems. Darkside subsequently claimed it had ceased its operations, citing law enforcement action as the reason for shutting down. The US Department of Justice later recovered about $2.3 million (USD) in bitcoin that the company had paid to the ransomware group. The Colonial Pipeline compromise highlights the potential for malicious cybercriminal activity to cause widespread disruption to businesses and individuals, even when the actor has not aimed to disrupt critical infrastructure. It also demonstrates the challenges of fully recovering from a ransomware incident and that business operations can remain disrupted even when a ransom payment is made and decryption tools are provided. This underscores the importance of maintaining strong cyber security practices, as well as the value of critical infrastructure organisations engaging closely with the international cyber security centres, including the ACSC, during any incident. 33