As disclosed in the reports, the attack took place from outside the US and spread through the network of Tribune Publishing. The ransomware subsequently targeted the printing and production systems that targeted multiple newspapers. The affected names included Los Angeles Times, New York Times, Wall Street Journal, Chicago Tribune, Post-Tribune, Capital Gazette, Baltimore Sun, Hartford Courant, Carroll County Times, and Lake County News-Sun.
As revealed by a Tribune spokesperson, the malware behind the attacks seems the Ryuk ransomware, as all the affected files had a “.ryk” extension. However, the affected publishers have not revealed much details about the technicalities of this attack. Nonetheless, Tribune Publishing has confirmed that their database remained safe during the attack.
https://twitter.com/malwrhunterteam/status/1069667203216236545
- malwrhunterteam
As revealed from the malware analyses, the files encrypted by Ryuk ransomware end up having “.ryk” extensions as their signature. The malware seems related to the Hermes ransomware strain linking back to the infamous Lazarus Group. This group of hackers from North Korea has been found responsible for several devastating cyber attacks including crypto hacks. The attacks involving this malware may employ phishing strategies. Whereas, the ransomware can also be spread by directly infecting unsecured remote desktop connections.
