Logo

Alan W. Dowd is a Senior Fellow with the American Security Council Foundation, where he writes on the full range of topics relating to national defense, foreign policy and international security. Dowd’s commentaries and essays have appeared in Policy Review, Parameters, Military Officer, The American Legion Magazine, The Journal of Diplomacy and International Relations, The Claremont Review of Books, World Politics Review, The Wall Street Journal Europe, The Jerusalem Post, The Financial Times Deutschland, The Washington Times, The Baltimore Sun, The Washington Examiner, The Detroit News, The Sacramento Bee, The Vancouver Sun, The National Post, The Landing Zone, Current, The World & I, The American Enterprise, Fraser Forum, American Outlook, The American and the online editions of Weekly Standard, National Review and American Interest. Beyond his work in opinion journalism, Dowd has served as an adjunct professor and university lecturer; congressional aide; and administrator, researcher and writer at leading think tanks, including the Hudson Institute, Sagamore Institute and Fraser Institute. An award-winning writer, Dowd has been interviewed by Fox News Channel, Cox News Service, The Washington Times, The National Post, the Australian Broadcasting Corporation and numerous radio programs across North America. In addition, his work has been quoted by and/or reprinted in The Guardian, CBS News, BBC News and the Council on Foreign Relations. Dowd holds degrees from Butler University and Indiana University. Follow him at twitter.com/alanwdowd.

ASCF News

Scott Tilley is a Senior Fellow at the American Security Council Foundation, where he writes the “Technical Power” column, focusing on the societal and national security implications of advanced technology in cybersecurity, space, and foreign relations.

He is an emeritus professor at the Florida Institute of Technology. Previously, he was with the University of California, Riverside, Carnegie Mellon University’s Software Engineering Institute, and IBM. His research and teaching were in the areas of computer science, software & systems engineering, educational technology, the design of communication, and business information systems.

He is president and founder of the Center for Technology & Society, president and co-founder of Big Data Florida, past president of INCOSE Space Coast, and a Space Coast Writers’ Guild Fellow.

He has authored over 150 academic papers and has published 28 books (technical and non-technical), most recently Systems Analysis & Design (Cengage, 2020), SPACE (Anthology Alliance, 2019), and Technical Justice (CTS Press, 2019). He wrote the “Technology Today” column for FLORIDA TODAY from 2010 to 2018.

He is a popular public speaker, having delivered numerous keynote presentations and “Tech Talks” for a general audience. Recent examples include the role of big data in the space program, a four-part series on machine learning, and a four-part series on fake news.

He holds a Ph.D. in computer science from the University of Victoria (1995).

Contact him at stilley@cts.today.

Costa Rica Declares State of Emergency After Crippling Ransomware Attack

Monday, May 16, 2022

Categories: ASCF News Emerging Threats

Comments: 0

Source: https://www.breitbart.com/latin-america/2022/05/12/costa-rica-declares-state-emergency-crippling-ransomware-attack/

EZEQUIEL BECERRA/AFP via Getty Images

The government of Costa Rica declared a state of emergency this week after a massive ransomware attack locked down computer networks across multiple government agencies, paralyzing tax collection and leaving the private information of Costa Rican citizens vulnerable.

According to the emergency declaration, the crisis began on April 12 with a “strong cyberattack on the databases of the Costa Rican Ministry of Finance.”

The attack spread to the “databases of other institutions” from there, becoming a major threat to national security. The Costa Rican statement said the full extent of the attack was not yet known.

NBC News reported on Wednesday that a notorious and highly destructive international ransomware gang called Conti appears to be responsible for the attack, having published documents pilfered from Costa Rican government computers to its dark website on Sunday.

The data dump posted by Conti is about 672 gigabytes in size and purportedly includes information stolen from the Finance Ministry, Ministry of Labor and Social Security, Social Development and Family Allowances Fund, and Interuniversity Headquarters of Alajuela. The hackers said they published the data after Costa Rica refused to pay $10 million in ransom.

Conti’s members appear to be mostly Russian and Eastern European. The group pledged allegiance to the Russian state when the invasion of Ukraine began. Its previous crimes include a $20 million ransomware attack on the Health Service Executive of Ireland and a failed attempt to breach dozens of American healthcare systems.

A Ukrainian cybersecurity expert claimed in February to have hacked Conti itself, exposing a trove of alleged chat messages and other correspondence between group members.

These messages indicated, if authentic, that Conti has ties to Russia’s FSB security service and its military hacking units, but seems to have an identity distinct from the Russian government — the group is willing and eager to work on Russia’s behalf, and apparently believes Russian agents would help if they got into legal trouble, but is not directly controlled by the Kremlin.

The Conti hacker who posted the data dump included a message stating, “no organized team was created for this attack, no government or other countries has finalized this attack, everything was carried out by me with a successful affiliate.”

“The purpose of this attack was to earn money, in the future I will definitely carry out attacks of a more serious format with a larger team, Costa Rica is a demo version,” the hacker said.

The state of emergency was declared by Costa Rican President Rodrigo Chaves, who was just sworn in on Sunday.

“We’ve signed the decree so the country can defend against the criminal attack that cyber criminals are carrying out. This is an assault on the nation and we have signed this decree to help us defend ourselves better,” Chaves said.

Cybersecurity site ThreatPost noted the Costa Rica attack, like most of Conti’s alleged recent jobs, employed a “double-extortion” strategy of threatening to release stolen data if the ransom was not paid.

Classic ransomware attacks encrypt the data without stealing it, demanding a ransom from the victim to obtain the software keys needed to unlock their own system. Ransomware has proven fearsomely lucrative because targeted corporate and government targets often conclude paying the ransom is cheaper, and much faster, than hiring experts to decrypt the data and free their captured systems.

Cyberdefense analyst Roger Grimes told ThreatPost that no matter what Conti chooses to dump on its dark web site, the group probably has “every employee’s personal login credentials to any Costa Rican government site that they visited during the time the ransomware was active on the system before it locked files.”

“If Costa Rica was hosting customer-facing websites in the compromised domains, like they likely were, their customers’ credentials – which are often reused on other sites and services the customers visit – are likely compromised, too. Not paying the ransom puts not only Costa Rica’s own services at risk, but those of their employees and customers,” Grimes said.

Security engineer Silas Cutler of the Stairwell security firm described Costa Rica’s state of emergency as a pivotal moment, an “important rallying call to the rest of the world.”

“While the emergency status may have a limited direct impact… it puts the severity of this breach into the same category as a natural disaster or military incident,” Cutler said.

The U.S. State Department last week posted a reward of up to $10 million for information leading to the identification and location of Conti group leaders, plus another $5 million for information leading to the arrest of “any individual in any country conspiring to participate in or attempting to participate in a Conti variant ransomware incident.”

The State Department cited the ransomware attack on Costa Rica as a prime reason for offering the bounty under its Transnational Organized Crime Rewards Program (TOCRP).

“In offering this reward, the United States demonstrates its commitment to protecting potential ransomware victims around the world from exploitation by cyber criminals. We look to partner with nations willing to bring justice for those victims affected by ransomware,” the State Department said.

Comments RSS feed for comments on this page

There are no comments yet. Be the first to add a comment by using the form below.