Chapter 2 WWW.TARGET.SG CASE STUDY ON RANSOMWARE ATTACKS Local Case Studies The global cyber threat landscape continues to evolve, and as a highly-connected financial hub, Singapore is an attractive target to malicious actors around the world. This section features selected case studies of companies that were compromised by various types of cyber threats. CASE STUDY ON POS ATTACKS Incident in the E-commerce Industry Incident in the Financial Sector What Happened? Follow-up Action In January 2020, employees at a local financial institution reported for work in the morning only to find that they were unable to access the files on their computer. Their files had been encrypted, and the employees were greeted by a ransom note demanding payment in Bitcoin to enable decryption and regain file access. A number of workstations and servers were affected, and the financial institution alerted the relevant authorities immediately. The company disconnected all infected workstations and servers from its networks to prevent further spread of the ransomware. Cybersecurity experts were also engaged to undertake incident response processes, clean up affected systems, and implement recovery efforts. Network sensors were deployed to monitor further malicious activity and signs of data exfiltration. There was no impact on the company’s business operations, and no sign that its data had been stolen. The systems were found to be infected with the Sodinokibi ransomware, a highly evasive and sophisticated strain likely linked to the GandCrab ransomware family due to similarities in their source codes. Sodinokibi was also suspected to be deployed in highprofile hits at international foreign currency exchange firm Travelex and the New York State’s Albany International Airport. What Happened? Follow-up Action In late-2019, customers of a local online fashion retailer were informed that hackers had tried to harvest their personal information by injecting a malicious code into the retailer’s e-commerce website. Upon discovering the data breach, the retailer alerted the Singapore Police Force (SPF) and Personal Data Protection Commission (PDPC). It also worked with cybersecurity experts to remove the malicious code from the affected website, and implemented measures to secure their systems. These measures included enforcing two-factor authentication (2FA) for back-end access, password resets for all user accounts, and further digital forensic analysis. Updates about the mitigation measures taken were also circulated to the retailer’s customers. Investigations revealed that the injected malicious code allowed a fake form to overlay the genuine web form used for collecting personal information from the retailer’s customers. Personal information that was subsequently stolen included the customers’ first and last names, e-mail addresses, shipping addresses, order details, payment type, and credit card information. 22 SINGAPORE CYBER LANDSCAPE 2019 Five suspicious Internet Protocol (IP) addresses related to malicious activities were found during the analysis of the company’s server logs. These IP addresses were linked to the Tor anonymity network, which was known to be frequently exploited by cybercriminals seeking to conceal their IP locations from network surveillance and traffic analyses. The discovery of Tor-linked IP addresses, together with the sophisticated nature of the ransomware deployed, indicated the involvement of a cybercrime syndicate. Businesses risk losing their reputations and consumer confidence if they do not take privacy issues seriously, or fail to protect their platforms with robust measures. They should ensure that their websites and databases are secure and regularly patched. 23