The threat of a ransomware attack shutting down water systems in the country is prompting US authorities to issue an industry-wide alert to stay on guard for potential cyber attacks.
Thursday’s warning comes from the FBI, NSA, and Cybersecurity and Infrastructure Security Agency (CISA), which cite four ransomware attacks over the past year that infected computers at water and wastewater systems in the country.
The most recent attack occurred in August. “Malicious cyber actors used Ghost variant ransomware against a California-based WWS (water and wastewater system) facility. The ransomware variant had been in the system for about a month,” the agencies say. The operators of the facility only learned of the attack when the hackers began displaying a ransomware message across the computers.
A ransomware attack in July also hit water facilities in Maine. At the time, local officials said the attacks posed no public safety threat. Nevertheless, they warned that hackers could have overridden the plant’s alarms or disabled critical pumps, according to StateScoop.
“This activity—which includes attempts to compromise system integrity via unauthorized access—threatens the ability of WWS facilities to provide clean, potable water to, and effectively manage the wastewater of, their communities,” the government agencies warned on Thursday.
US authorities didn’t mention a motive for the attacks, but ransomware gangs typically prioritize profits. As a result, they’ll attempt to infect any vulnerable IT system with ransomware, even if it's a hospital or considered US critical infrastructure. This occurred in May when a ransomware variant hit IT systems belonging to Colonial Pipeline, prompting it to temporarily halt operations.
To stop the attacks, the joint advisory from the US government agency includes steps that water facilities can take to shore up their IT defenses. The advisory calls out the threat of spear phishing emails, which can be used to trick an unwitting employee into opening a booby-trapped document or internet link to download malware to a computer.
US authorities are also advising water system operators to avoid running software and operating systems that are out of date or no longer supported. The other potential threat involves an employee at a facility going rogue. In 2019, one former worker at Kansas water facility abused his access to allegedly tamper with the water treatment processes.