Ransomware attack: Andhra Pradesh police, firms hit; CERT issues advisory

Govt & private cybersecurity experts were pressed into service to decrypt the affected systems

Nearly a dozen companies in India and about 18 computers of the Andhra Pradesh (AP) police were affected in the global ransomware attack, which was first detected on Friday and spread across the globe on Saturday. Government and private cybersecurity experts were pressed into service to decrypt the affected systems.

Indian Computer Emergency Response Team (CERT-In) has issued an advisory on what precaution to take and update security for computers and servers. It was working closely with various nodal agencies to assess vulnerabilities in government systems.

The biggest impact so far has been on computers used by the Andhra Pradesh police — 18 units across five districts, including Visakhapatnam and Srikakulam, have been hit. Private cybersecurity firms have reported instances of computers being locked because of the ransomware attacks in Gujarat, as well as Mumbai, Hyderabad, Coimbatore and Bengaluru.

 

“The only known impact has been of the AP police so far,” CERT-In Director General Sanjay Bahl told Business Standard. CERT-In has asked people to report any cyber attacks immediately.

E Damoder, inspector general of police, technical, Andhra Pradesh, said the police department’s data and computer network remained intact. “Only 18 laptops and desktops, out of 6,000 in the department, have been affected. We quickly isolated these from the system yesterday (Friday).”

The department’s Criminal Control Tracking System, citizen interface applications and data stored in the servers were not affected. “As such the department’s computer system works on Linux and Ubuntu operating systems, considered safe. We have been in touch with the nodal agencies of the Ministry of Electronics and Information Technology for further precautions,” Damoder said.

Those using Microsoft’s Windows seemed more vulnerable.

A CERT-In team has been working round the clock to monitor the situation and assist individuals and organisations with affected systems. Most large organisations have issued internal advisories.

Digital security services firms TAC Security and Lucideus said they had received request from clients across cities to decrypt affected systems. This included a midsized company in Gujarat and Hyderabad, and a large corporate entity in Mumbai.

“We have two requests,” said Saket Modi, founder, Lucideus, which has built a tool to assist companies to find vulnerabilities and fix them.

“We have got enquiries from three clients. We are trying to decrypt nine systems in a company in Mumbai,” said Trishneet Arora, founder and chief executive officer of TAC, another cyber security firm.

While the size and scale of the latest ransomware attack has caught global attention, cyber security experts say they see three to four such attacks every week.

“What we see is just the start (in cyber attacks). India now has more internet connections and the scale of attacks will increase by two to three times in the coming days,” said Arul Selvar, technical head of National Cyber Safety and Security Standards.