Ransomware Attack Forced New Orleans In The U.S. To Declare A State Of Emergency

Ransomware hackers are always on the move to find their next potential and vulnerable victim.

And here, the city of New Orleans in the U.S., was under attack, as officials found a suspicious uptick in activity, particularly in phishing attempts and ransomware, Kim LaGrue, the city’s head of IT said in a press conference.

The attack was confirmed by officials, saying that it went for about three hours later after the increased activities.

The officials were forced to declare a state of emergency, and temporarily shut down the affected city's servers and computers to curb the attack.

Thanks to the quick decision, the city's services remained operational. The police, fire and EMS are all functional because their servers operate outside the city's internet network. Emergency communications and cameras throughout the city are also not affected by the cybersecurity incident.

New Orleans appeared to be somewhat prepared, and officials said that they were trained to to what they need to do without the internet.

For example, some building inspections were handed manually at the time of attack. Some workers at the city offices, were resorting to using pen and paper, according to New Orleans‘ director of homeland security Collin Arnold.

"If there is a positive about being a city that has been touched by disasters and essentially been brought down to zero in the past, is that our plans and activity from a public safety perspective reflect the fact that we can operate with internet, without city networking," said Arnold.

Previously, numerous local and state governments have been attacked by ransomware.

The file-encrypting malware demands money, usually in Bitcoins, in return for the decryption key.

Governments and local authorities are particularly vulnerable as they’re often hold precious data, and are underfunded or not well-resourced. As a result, they can be more vulnerable to some of the major and modern threats.

A while later, Bleeping Computer reported that someone from an IP address in the U.S. uploaded memory dumps of suspicious executables to the VirusTotal scanning service, one day after the attack.

The data has references to the New Orleans' domain names, domain controllers, internal IP addresses, usernames, file shares, and references to the Ryuk ransomware, noted researcher Colin Cowie from Red Flare Security, who shared his finding with Bleeping Computer.

The finding made Bleeping Computer to suggest that Ryuk is likely responsible for the New Orleans attack.

In the past, Ryuk victims include those from state-owned oil refineries, hospitals, schools, care facilities, and government institutions worldwide.