Colonial Pipeline Ransomware attack linked to a single VPN ID

The oil pipeline ransom increase last month that fuel shortages and shipping of $ 4.4 and a payment of $ 4.4 to attackers have apparently been found at an unused but still active VPN connection. Execus Exec Charles Carmakal told Bloomberg that their analysis of the attack revealed that the suspect activity on the network of the colonial pipeline began on April 29th.

Although they can not confirm exactly how the attackers have got the connection, there is apparently no evidence of phishing, sophisticated or other techniques. What they found is that the employee’s password was present in a shared connection discharge on the dark web, so if it has been reused and the attackers corresponded to a name of User, this could be the answer to the way they engaged.

Then, just over a week later, a ransom message appeared on the pipeline capital screens and the staff started closing operations. Although just one in an endless chain of similar incidents, the impact of the closure was large enough that the CEO of the Pipeline Capital should testify before the Congress Committees next week and the doj centralized answers Ransomware in the way similar to how it deals with cases of terrorism