CERT-In warns organisations against Ransomware that targets critical infrastructure

The Indian Computer Emergency Response Team (CERT-In) has warned users against ViperSoftX, an information stealing malware and Royal Ransomware that has been targeting multiple critical infrastructure sector. In advisories dated May 2 and May 3 respectively, the nodal agency for cybersecurity warned against these ongoing cyber-attacks while recommending several best practices to safeguard data and their network infrastructure. 

CERT-In just a few weeks back in a report, stated that there has been a 53 per cent increase in ransomware incidents in India in 2022 when compared to 2021. Earlier the government had also informed in the Parliament that 19 ransomware attacks were recorded against various government organisations in 2022 

This report also comes at a time when Indian government websites have been reported of being targeted by Indonesian hacktivists. Also a few months back, the All India Medical Institute of Medical Sciences suffered a major ransomware breach that rendered several of its services inaccessible. 

"It has been reported that a ransomware, dubbed “Royal ransomware” is targeting multiple crucial infrastructure sectors including manufacturing, communications, healthcare, education, etc. or individuals. The ransomware encrypts the files on a victim's system and attackers ask for ransom payment in bitcoin. Attackers also threaten to leak the data in public domain also if denied payment," CERT-In said in an advisory. 

The agency said that the ransomware spreads through phishing emails, and other forms of social engineering attacks. "Threat actors have followed many tactics to mislead victims into installing the remote access software as a part of callback phishing, where they pretend to be various service providers," it read. 

After Royal Ransomware gets access to a network, it disables anti-virus protocols, exfiltrates large amount of data before encrypting them. It adds the ."royal" extension to encrypted file names, CERT-In said.