Chile’s National Computer Security and Incident Response Team CSIRT has announced a cyberattack on a government agency. CSIRT stated that the attack began on Thursday, August 25 and targeted Microsoft and VMWare ESXi servers operated by the agency.
The attackers stopped all running virtual machines and encrypted their files by adding the “.encrypt” file extension. Although the report of the Chilean CSIRT shows that attackers have provided a communication channel to negotiate the payment of a ransom, the authority has not specified the ransomware gang behind the attack.
The malware used in the attack is able to steal login credentials from any browser, list removable devices for encryption and bypass antivirus detection by execution timeouts. The attackers set a three-day deadline for paying the ransom or selling the stolen login credentials to other cyber criminals.
Chile’s cybersecurity organization recommends that all state entities and large private organizations take some security measures, including using a properly configured firewall and antivirus tool, updating VMware and Microsoft assets, and backing up key data.
Others include checking the configuration of anti-spam filters and training staff to detect malicious emails, introducing network segmentation and constantly informing and mitigating new vulnerabilities.
The sources for this piece include an article in BleepingComputer.