According to DerStandard.at, the IT systems of the state of Carinthia, the district authorities, the state administrative court and the Court of Auditors were hit by a ransomware attack. 100 of the 3.700 IT jobs are probably affected. The Black Cat or ALPHV ransomware is demanding a ransom of $5 million in bitcoins.
The in-house IT experts of the state of Carinthia apparently still have their hands full. As early as May 14, 2022, a PC in the administration seems to have fallen victim to ransomware from the blackmail group Black Cat or ALPHV. Black Cat, also known as ALPHV, is a relatively new ransomware-as-a-service gang. Security researchers believe they are related to the BlackMatter and Darkside ransomware gang respectively. Darkside was the attacker who attacked Colonial Pipeline in May 2021 and thus partially paralyzed the gasoline supply in the USA.
$5 million in bitcoins as a ransom
The Black Cat and ALPHV groups are demanding $5 million in bitcoins for decryption software. The good news: the Carinthian administration does not want to pay. After all, every bitcoin paid is an investment for a new attack. According to DerStandard and Gerd Kurath, head of the state press service: “It is not paid. The further procedure is now being coordinated with the State Office for the Protection of the Constitution and the police. There is currently no evidence that data was actually siphoned from the system." Kurath also points out that backups of all relevant data are available.
Current and next steps
100 of the country's 3.700 IT workstations are infected and are therefore switched off or isolated. You only want to unlock the IT systems again when you are absolutely sure that the malware has been eliminated. “The systems are gradually being ramped up. It is not yet possible to estimate how long this will take,” says Kurath. He also says: “Because you are dependent on the IT systems, the administration is in emergency mode. All employees of the authorities are trying to process urgent concerns of the citizens”.
More at DerStandard.at