The city of Dallas, Texas, has fallen victim to a recent ransomware attack resulting in the shutdown of several city services and systems. The attack was carried out by the Royal ransomware gang, a threat actor that has been active since early 2022.
The attack compromised several of the city’s servers, causing widespread service outages. This includes the 911 dispatch system. As a result, 911 operators were forced to write instructions for responding officers manually. The attack also impacted the Computer Aided Dispatch (CAD) systems essential for all of the city’s emergency response services.
The Royal ransomware gang typically gains entry to victims’ networks using callback phishing attacks. They send emails that claim the victim has or will be charged for a service, and then ask them to call a listed phone number for clarification. Once they gain access, they disable antivirus software and exfiltrate large amounts of data before deploying the ransomware and encrypting the targeted systems.
Royal ransomware used printers on the city of Dallas’ network to print ransom notes that included a threat to publish critical data online if the ransom demand was not met. It directed the reader to a contact form on Royal’s dark web victims’ site. The note stated that critical data had been encrypted and threatened to release it online if the ransom was not paid.
Royal Ransomware note.
Acreto Solution
Acreto Ecosystems are trusted by cyber insurance carriers as the most effective method to prevent ransomware. Many cyber insurance carriers recommend and at times mandate Acreto to make high-risk customers insurable. Ecosystem security addresses this challenge by:
Providing a dedicated security infrastructure per application or use case. This means that only users, devices, systems and applications that need to interoperate can interconnect and have access regardless of the type of technology, its location, network or ownership. All other technologies are automatically isolated without any additional effort. This is done by the use of micro-segmentation and nano-segmentation
Only communications where the network protocol and port, application protocol and application programs criteria are met are allowed. All other communications are excluded. Ransomware cannot emulate application programs.
Ecosystem Security Isolation
Ecosystems deliver a dedicated security infrastructure that can be deployed per application, use-case, project or third-party. An Ecosystem inherently limits access only to users, devices, systems and applications that need to interoperate together.
Ecosystems support any technology, on any network, anywhere in the world. These include computers, mobile devices, IoTs, Offices, Clouds, SaaS and Data Centers.
Ecosystems can be configured as:
Open → With inbound or outbound access from or to the Internet or a third-party
Closed → Fully contained with access limited to Ecosystem members
Hybrid → Where some systems have inbound or outbound Internet access while others operate fully contained.
Assets Acreto Secures
Supported Technologies Detail
Access Technologies
Devices
Computer (Org Owned or BYOD)
Mobile Phone / Tablet (Org Owned or BYOD)
Offices
Headquarters
Branch
Small Office / Home Office
Internet-of-Things (IoT)
ATMs
HVAC
Elevator Controls
Fire Safety
Smart TV
many more…
Third Parties
Offices
Devices
Remote Users
Application Delivery Technologies
Data Center
Networks
Servers
Virtual Machines
Containers
Clouds
Cloud Instances
Cloud VPCs / Cloud Networks
SaaS / Third-Party Applications
Eliminate the Internet Attack Surface
Eliminates any and all access from the Internet while Ecosystem members can interoperate with authorized systems and applications.
Eliminate the Internal Attack Surface
Ecosystems can easily isolate individual or groups of systems on a shared network or entire networks, to limit access only to systems that need to interoperate together. This is done with
Micro-Segmentation Segmenting groups of systems on any shared network, including hostile networks or the entire network.
Nano-Segmentation Isolating an individual system, device or application to limit access only to other authorized Ecosystem members.
Isolated Data Flows
Isolated data flows can be defined between two Ecosystem members to limit access to specified sources and destinations, network protocols and ports, application protocols as well as application programs.
Encrypted Secure Scan
Secure Scan addresses a key weakness in many security tools today. 90%+ of all communications is encrypted, yet only 10% of organizations have the means to secure these communications. Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time.
Any malicious content embedded in the encrypted payload is blocked, otherwise the clean and validated communication is delivered to its final destination.
Controls
Access Control
Identity with MFA
User Authorizes access to the Ecosystem by a user’s identity, including MFA, as authenticated by the organizations Directory Services such as Active Directory or LDAP, as well as third-party Identity Service Providers such as Okta, Ping, Duo, and CloudJump among others.
Device Specifies a unique identity to each device to validate that a specified device that does not rely on a user to operate – such as an autonomous application or IoT, is allowed to join the Ecosystem.
Network Protocol / Port
Control the network protocol (TCP, UDP, ICMP) and Port (1-65535) any Ecosystem member can use to communicate with any other Ecosystem member or Internet resource by IP, user or device identity. Both inbound and outbound Internet flows are supported.
Application Protocol
Control the application protocol (HTTP, DNS, SMTP, SMB, etc…) any Ecosystem member can use to communicate with any other Ecosystem members or Internet resource by IP, user or device identity. Both inbound and outbound Internet flows are supported.
Application Program
Control the application program (MS-Exchange, Oracle, Facebook, GMail, etc…) any Ecosystem member can use to communicate with any other Ecosystem members or Internet resource by IP, user or device identity. Both inbound and outbound Internet flows are supported.
Content
Content Category
Control communication based on content categories such as Adult, Gambling, Politics, Malware sites among 90+ category options.
File Type Upload / Download Controls
Control upload / download of files by type such .EXE, PDF, XLS, DOC, SCR, and MSI among hundreds of options.
Data Leak Prevention
Prevent data leaks by identifying and mitigating the upload or download of sensitive data such as:
Credit Cards Upload / Download Controls
Social Security Number Upload / Download Controls
RegEx Pattern Upload / Download Controls
Threat Prevention
After verification of network protocol, port, application protocol and application program, a deep inspection is performed on all communications. The effectiveness of this method is amplified by inline Encrypted Secure Scan. Threat prevention capabilities utilize two key methods:
Threat Signature Identifies and mitigates known bad exploits, malware, botnets and ransomware.
Zero-Day Behavioral Analysis Looks for behavioral indication of threats based on how system functions react to the payload, immediately and over time.
Simplicity
Acreto Ecosystems are very easy to provision and deploy. There are no hardware dependencies or associated logistics.
Provisioning an Ecosystem takes 3-5 minutes. Simply provide a unique name to the Ecosystem then choose the bandwidth desired and within a few minutes your Ecosystem providing a dedicated security infrastructure is ready.
Depending on your connection options for Ecosystem members, deployment can take between 10 minutes to a few hours.
Sustainability
Acreto Ecosystems utilize a sustainable model without any dependency on products and their associated logistics. There are no more updates, upgrades or technology refreshes.
Change Management
Different Ecosystems operate completely independently from one-another. Therefore, change management impacts only members of a specified Ecosystem, not the entire organization. This simplifies the traditionally complex change management process.
Policy Management
Policy management also benefits from Ecosystems. Because Ecosystems are specific to a customer scenario such as an application, use-case, project or third-party, all policies apply to the scenario. Moreover, when its time for policy cleanup, when an application or use-case is retired, disabling or deleting the Ecosystem automatically prunes the policies. This has traditionally been a complex task that is at best inaccurate.
Mechanism of Attack
Royal ransomware gang breaches networks using vulnerabilities in Internet-exposed devices.
They commonly use callback phishing attacks to gain initial access to corporate networks.
Callback phishing attacks impersonate food delivery and software providers in emails pretending to be subscription renewals.
Instead of containing links to phishing sites, the emails contain phone numbers that the victim can contact to cancel the alleged subscription.
When a victim calls the number, the threat actors use social engineering to convince the victim to install remote access software.
The remote access software allows the threat actors access to the corporate network.
The ransom note left by the Royal ransomware gang was in the form of a text file named “README.txt.” This file was placed in the root directory of each encrypted device and contained instructions on how to pay the ransom to obtain the decryption key.
About Acreto
Acreto delivers full-stack cybersecurity without products, logistics or significant security expertise. It creates and consolidates the best of cybersecurity into a single plug-and-play platform with automated updates to stay ahead of threats. Acreto activates enterprise-grade security instantly, so organizations can run safely, easily, and without interruption.
