Malware Attack Report: Zenith Stock Exchange

MALWARE ATTACK REPORT
CASE STUDY: ZENITH STOCK EXCHANGE

HOW IT HAPPENED
• ON 31ST JANUARY, ZENITH WOKE UP TO A MALWARE (SPECIFICALLY RANSOMWARE) ATTACK.
THE HACKERS WERE IN POSSESSION OF THE ENTIRE DATA LOAD OF THE STOCK EXCHANGE
DATA. THE DATA THEY HAD GOT HOLD OF WAS VERY VITAL AND COULD BE VERY
DAMAGING TO THE ORGANIZATION. IN THEIR RANSOM DEMAND THE HACKER GROUP
WANTED AN EQUIVALENT OF US$25M IN BITCOIN. THE ORGANIZATION HAD NOTHING TO
DO BUT TO GIVE IN TO THE DEMANDS OF THE HACKER GROUP. THE HACKER GROUP KEPT
THEIR WORD AND RESTORED ACCESS TO THE DATA. THE DATA AUDITORS HAVE SINCE
CONFIRMED THAT EVERYTHING IS INTACT AND WE, THE DATA SECURITY TEAM HAVE
STEPPED IN AND MITIGATED THE DAMAGE DONE. THE PRESENTATION IS AN EXPLANATION
AND PREEMPTION ON WHAT MEASURES ARE NEEDED TO AVOID THIS KIND OF ATTACK IN
THE FUTURE.

POINT OF ENTRY
BASED ON FINDINGS BY THE TEAM, THE MALWARE FOUND ITS WAY INTO OUR
SYSTEM THROUGH ONE OF THE MOST COMMON MALWARE DELIVERY SYSTEMS.
THE HACKER GROUP SENT OUR HEAD OF SECURITY AN ALERT THAT SEEMED
TO BE FROM A GENUINE EMAIL ADDRESS. HE OPENED THE EMAIL AND THE
MALWARE STARTED PROPAGATING INTO THE SYSTEM. AFTER A FEW DAYS, THE
MALWARE WHICH WAS CONFIGURED AS A RANSOMWARE HAD TAKEN CONTROL
OF THE SYSTEM BY MIMICKING THE SYSTEM ADMIN PASSWORDS. THE ENTIRE
SYSTEM WENT ON A LOCKDOWN AND THE RANSOM MESSAGE REMAINED ON
THE SCREENS UNTIL THE ORGANIZATION CAME TO AN AGREEMENT WITH THE
HACKER GROUP.

TABULAR RISK ASSESSMENT