The Ransomware Files

Dr. Ransomware, Part 1

The FBI’s Most Wanted list for cybercrime has a recent entry: Moises Luis Zagala Gonzalez. He is a 55-year-old cardiologist living in Ciudad Bolivar, Venezuela. He has a bald head and an earnest smile. In one photo, he wears a doctor’s white overcoat with a stethoscope around his neck. What is this man doing on that list? U.S. prosecutors allege Zagala lead a double life. They allege he’s also a cybercriminal. Zagala is charged in federal court in New York with developing ransomware applications called Jigsaw and Thanos that infected organizations and companies around the word. They claim his hacking career stretches back to the late 1990s when he was part of an expert reverse software engineering group. Who is Moises Zagala, and why does the U.S. think he’s a ransomware mastermind? Speakers: Alexander Mindlin, Assistant United States Attorney, Eastern District of New York; Lindsay Kaye, Senior Director, Operational Outcomes, Insikt Group, Recorded Future; Thomas Holt, Professor, School of Criminal Justice, Michigan State University; Ana Vanessa Herrero, Journalist; Jeremy Kirk, Executive Editor, Information Security Media Group. Sources and transcript for this episode are here. Special thanks to Ana Vanessa Herrero in Caracas for reporting and research that contributed to this episode. Thanks also to ISMG’s Tom Field and David Perera for production assistance. Production Coordinator: Rashmi Ramesh The Ransomware Files theme song by Chris Gilbert/©Ordinary Weirdos Records Other original music by Chris Gilbert, India Kirk and Jeremy Kirk Additional music by Podcastmusic.com Follow The Ransomware Files on Twitter: @ransomwarefiles Follow The Ransomware Files on Instagram: @theransomwarefiles

Travelex

Ransomware struck global currency exchange and remittance company Travelex on New Year's Eve 2019. Security Architect Don Gibson was DJing at a friend’s place when the first alerts came in. That night kicked off turbulent period for Don that lasted throughout the rest of the year. His name became publicly linked with the Travelex incident, and the attention was completely undesired. His story is one of how social media, a frantic incident response and stress contributed to a nearly tragic health outcome. He went from IR, or incident response, to the ER – the hospital's emergency room. Speakers: Don Gibson, former Security Architect, Travelex; Jeremy Kirk, Executive Editor, Information Security Media Group. Sources and transcript for this episode are here. Production Coordinator: Rashmi Ramesh. The Ransomware Files theme song by Chris Gilbert/©Ordinary Weirdos Records. Music by Uppbeat and Podcastmusic.com. Follow The Ransomware Files on Twitter: @ransomwarefiles Follow The Ransomware Files on Instagram: @theransomwarefiles

Bonus Ep: REvil Is Foiled

If software has a dangerous and easy-to-exploit security vulnerability, should its maker tell customers to shut it down until it’s fixed? It’s a tough call, but one that Dutch company Hoppenbrouwers says the software vendor Kaseya should have undertaken last year to prevent a massive supply-chain attack executed by the REvil ransomware gang. The gang had uncovered flaws in Kaseya's Virtual Systems Administrator product that Kaseya was racing to patch. Hoppenbrouwers was one of more than 1,500 victims. Its systems were nearly completely encrypted, but it recovered quickly using backups. Transcript for this episode is here. Speakers: Marcel de Boer, Financial Director, Hoppenbrouwers; Jeremy Kirk, Executive Editor, Information Security Media Group. Production Coordinator: Rashmi Ramesh. The Ransomware Files theme song by Chris Gilbert/©Ordinary Weirdos Records. Music by Podcastmusic.com. Follow The Ransomware Files on Twitter: @ransomwarefiles Follow The Ransomware Files on Instagram: @theransomwarefiles

Ryuk's Rampage

Rockford Public Schools in Illinois was infected with the Ryuk ransomware just days after the school year started in September 2019. They had one thought for the suspected Russia-based cybercriminal group at the root of the attack: "Screw them." The attack encrypted upwards of six million files, wrecked applications and locked up servers. But the district refused to pay the ransom and kept classes running while mounting a mighty recovery effort. Speakers: Jason E. Barthel, Chief Information Officer, Rockford Public Schools; Earl Dotson Jr., Chief Communications Officer, Rockford Public Schools; Cathy Bayer, Senior Communications Manager, Rockford Public Schools; Doug Levin, National Director, K12 Security Information Exchange; Errol Weiss, Chief Security Officer, Health Information Sharing and Analysis Center; Jeremy Kirk, Executive Editor, Information Security Media Group. Sources and the transcript for this episode are here. Production Coordinator: Rashmi Ramesh. The Ransomware Files theme song by Chris Gilbert/©Ordinary Weirdos Records. Music by Uppbeat and Podcastmusic.com. Follow The Ransomware Files on Twitter: @ransomwarefiles Follow The Ransomware Files on Instagram: @theransomwarefiles

Kaseya and REvil

The REvil ransomware gang's attack against the US software company Kaseya in 2021 is not only amongst the largest ransomware attacks of all time, but it's also one of the most intriguing. It involves the use of zero-day software vulnerabilities known only to a handful of people, a race between attackers trying to snare ransom payments and defenders developing a patch, and a secret operation that hacked back against the REvil hackers. And in the end, a rare action happened: Someone was actually arrested. This episode of The Ransomware Files also coincides with the release of new technical information from the Dutch Institute for Vulnerability Disclosure about the software vulnerabilities that were exploited by the ransomware gang. The information, which describes the vulnerabilities in Kaseya's Virtual Systems Administrator software, can be found on DIVD's website. Speakers: Robert Cioffe, Founder, Progressive Computing; Frank Breedijk, Manager, CSIRT, DIVD; Victor Gevers, Chairman, DIVD; Jason Manar, Chief Information Security Officer, Kaseya; Jon DiMaggio, Chief Security Strategist, Analyst1; John Hammond, Senior Security Researcher, Huntress; Espen Johansen, Security Director, Visma Group; Adrian Stanila, Senior Information Security Researcher, Visma Group; George Zamfir, Security Analyst, Visma Group; Jeremy Kirk, Executive Editor, Information Security Media Group. Sources and the transcript for this episode are here. Production Coordinator: Rashmi Ramesh. The Ransomware Files theme song by Chris Gilbert/© Ordinary Weirdos Records. Music by Uppbeat and Podcastmusic.com. Follow The Ransomware Files on Twitter: @ransomwarefiles Follow The Ransomware Files on Instagram: @theransomwarefiles