The FBI and CISA (the Cybersecurity and Infrastructure Security Agency) have jointly issued an advisory to organisations, warning about an increase in the number of attacks coinciding with weekends and holidays.

With the Labor Day weekend rapidly approaching, the agencies have reminded businesses to be especially vigilant, remain diligent about their network defences, and “engage in preemptive threat hunting on their networks to search for signs of threat actors.”

To underline their point, the FBI and CISA have warned that they have noted a trend for ransomware and other cyber attacks to occur at times when offices are normally closed. To underline the seriousness of the issue, the agencies have detailed three major ransomware attacks in recent months that coincided with holiday weekends, causing significant disruption:

In May 2021, leading into Mother’s Day weekend, malicious cyber actors deployed DarkSide ransomware against the IT network of a US-based critical infrastructure entity in the Energy Sector, resulting in a week-long suspension of operations. After DarkSide actors gained access to the victim’s network, they deployed ransomware to encrypt victim data and — as a secondary form of extortion — exfiltrated the data before threatening to publish it to further pressure victims into paying the ransom demand. In May 2021, over the Memorial Day weekend, a critical infrastructure entity in the Food and Agricultural Sector suffered a Sodinokibi/REvil ransomware attack affecting US and Australian meat production facilities, resulting in a complete production stoppage. In July 2021, during the Fourth of July holiday weekend, Sodinokibi/REvil ransomware actors attacked a US-based critical infrastructure entity in the IT Sector and implementations of their remote monitoring and management tool, affecting hundreds of organizations — including multiple managed service providers and their customers.

The high-profile cases highlighted by the FBI and CISA emphasise an important (Read more...)