Huge Norwegian aluminium plants hit by cyber-attack

ronjor · Mar 19, 2019

BBC 19 Mar 2019

The operator of one of the largest aluminium plants in Europe has switched to manual operations at its smelting facilities following a cyber-attack.
Hydro, which employs more than 35,000 people in 40 countries, says the attack began on Monday night and is ongoing.
Click to expand...

hawki · Mar 19, 2019

"Norway says Norsk Hydro has been exposed to LockerGoga ransomware attack

OSLO - Aluminum producer Norsk Hydro has been exposed to a LockerGoga ransomware attack, a spokesman for the Norwegian National Security Authority, in charge of cyber security, told Reuters on Tuesday..."

https://www.todayonline.com/world/n...has-been-exposed-lockergoga-ransomware-attack

https://www.bleepingcomputer.com/ne...ansomware-sends-norsk-hydro-into-manual-mode/

"What is LockerGoga?..."

https://www.pcrisk.com/removal-guides/14386-lockergoga-ransomware

hawki · Mar 19, 2019

"...Hydro doesn’t know the identity of the hackers, but believes the attack originated in the U.S...."

https://www.bloomberg.com/news/arti...ve-cyber-attack-impacting-operations-jtfgz6td

hawki · Mar 19, 2019

"Norsk Hydro Shuts Plants Amid Ransomware Attack

The cyberattack, first detected on Monday night, has shut down Norsk's entire global network..."

https://www.darkreading.com/iot/norsk-hydro-shuts-plants-amid-ransomware-attack/d/d-id/1334195

ronjor · Mar 20, 2019

Nordic metals firm Hydro restoring systems after cyber attack

Nerijus Adomaitis, Terje Solsvik March 20, 2019
OSLO (Reuters) - Norsk Hydro, one of the world’s largest aluminum producers, has made some progress restoring operations but is not yet back to normal after it was hit by a ransomware cyber attack, the company said on Wednesday.
Click to expand...

guest · Mar 21, 2019

The Norsk Hydro cyber attack is about money, not war
March 21, 2019
https://www.wired.co.uk/article/norsk-hydro-cyber-attack

However, cybersecurity experts have been watching developments closely, not least because of the type of business that was targeted. “Initially it looked really bad because of the industry these guys are in,” says Mikko Hypponen, the chief research officer at the Finnish cyber security firm F-Secure.

Robert Pritchard, a cybersecurity expert, says that LockerGoga does not self-propagate. It means somebody compromised Norsk Hydro's network -- uploaded the worm, and then deployed it across its network.

“There is no replication mechanism, this is not a worm, it is a targeted attack by the criminals,” he says.
The motivation appears to be straightforward. “There is no way to connect the dots to make this look like a governmental attack at all, it’s criminal, it’s about money,” he adds.

The attack shows how just attacking a Windows infrastructure – which is pretty simple to do and lots of people have the skills to do – can cause a lot of disruption, he adds.
Click to expand...

itman · Mar 21, 2019

The attack shows how just attacking a Windows infrastructure – which is pretty simple to do and lots of people have the skills to do – can cause a lot of disruption, he adds.
Click to expand...

Says it all in "A nutshell."

guest · Mar 22, 2019

Update on cyber attacks March 21
Following the extensive cyber attack earlier this week, Hydro has made further progress in securing safe and stable operations across the company
https://www.hydro.com/nl-NL/media/news/2019/update-on-cyber-attacks-march-21/

“With a systematic approach our experts are step by step restoring business critical IT based functions to ensure stable production, serve our customers and limit financial impact, while always safeguarding our employee’s safety,” says CFO Eivind Kallevik.

The root cause of the problems has been detected, a cure has been identified, and together with external partners, including national security authorities, Hydro’s experts are working on reverting virus infected systems back to a pre-infected state.
The attack has been reported to Norway’s National Investigation Service (Kripos) and the police have opened an investigation.
Click to expand...

guest · Mar 22, 2019

Industry Reactions to Norsk Hydro Breach: Feedback Friday
March 22, 2019
https://www.securityweek.com/industry-reactions-norsk-hydro-breach-feedback-friday

Industry professionals have commented on the incident, the way Norsk Hydro has responded to it, its implications, and what companies can do to protect their systems.
And the feedback begins…

"[...] They kept their networks and admins under one domain. Norsk Hydro had all their eggs in one basket, so when the fire started, it spread everywhere quickly. [...]"

“Hydro started the best incident representation response plan I’ve ever seen — they had a temporary website up, they told the press, they told their staff, they apparently didn’t hide any details — [...] It looks like it may be a textbook example of how incident response should be done"
[...]
Click to expand...

hawki · Mar 26, 2019

"Two U.S. chemical companies disclose cyberattack; LockerGoga ransomware reportedly the culprit

Just days after a ransomware attack disrupted operations at Norwegian aluminium company Norsk Hydro, two U.S.-based chemical companies last Friday disclosed that they were affected by an unspecified network security incident that blocked access to certain IT systems and data.

Reports suggest the incidents could be the work of LockerGoga, the same malicious encryption program that infected Norsk Hydro on March 18..."

https://www.scmagazine.com/home/sec...ompanies-disclose-reportedly-similar-inciden/

guest · Mar 26, 2019

Norsk Hydro's initial loss from cyber attack may exceed $40 million
March 26, 2019
https://www.reuters.com/article/us-...er-attack-may-exceed-40-million-idUSKCN1R71X9

Norwegian aluminum maker Norsk Hydro may have lost more than $40 million in the week that followed a cyber attack that paralyzed parts of its operations, and a full recovery of IT systems will take weeks or more, the company said.
“In the most affected business area, Extruded Solutions, production is now at 70-80 percent, except for the Building Systems business unit, where operations remain almost at a standstill,” Hydro said.
Hydro has said it will not pay hackers to unlock its files, preferring instead to restore them from backup servers.

“The company has now entered the recovery phase following the attack, gradually restoring IT systems in a safe and secure manner to ensure progress toward normal business while limiting the impact for people, operations, customers, suppliers and other partners,” Hydro said in a statement.
Click to expand...

guest · Apr 9, 2019

LockerGoga: It's not all about the ransom
In some cases, LockerGoga makes it very difficult to pay blackmail demands to decrypt systems
April 9, 2019
https://www.zdnet.com/article/indus...a-forces-victims-to-go-back-to-pen-and-paper/

In a blog post on Tuesday, Securonix published a detailed report on the capabilities of LockerGoga strains active today.

The infection vector of LockerGoga has not been verified, but as in many cases of business compromise, it is likely that phishing messages represent the initial stage. The researchers say that Microsoft Word or RTF documents containing embedded, malicious macros are suspected culprits.

"The most likely attack progression [is] that an initial compromise was followed by manual operator placement and modification of one of the existing logon script entries in the Netlogon directory on an AD resource [...], which allowed the binary to automatically propagate and be executed by users within the organization during a logon session," Securonix says.
"This indicates that the attackers objectives' may have included additional goals that are not part of a traditional ransomware modus operandi, such as cybersabotage," the team says.
Click to expand...

guest · Apr 13, 2019

Norsk Hydro's earnings delayed by five weeks due to March cyber attack
April 12, 2019
https://www.reuters.com/article/us-...eport-due-to-march-cyber-attack-idUSKCN1RO1YK

Norsk Hydro, one of the world’s largest aluminum makers, will postpone its first-quarter earnings report by more than a month as it struggles to recover from a March cyber attack, the company said on Friday.

Hydro now aims to publish its results on June 5, five weeks later than planned, as it tries to gain access to administrative systems for reporting, billing and invoicing that were blocked by hackers demanding a ransom.
“The revised date is conditional upon the planned timeline for restoring operational and reporting systems,” Hydro said in a statement.

“We are well on our way, but it will take time before we are fully back to normal IT operations,” he added.
Click to expand...

hawki · Apr 30, 2019

"Norsk Hydro expects cyber attack costs of nearly $52 mln in Q1

OSLO, April 30 (Reuters) - Norsk Hydro said the March cyber attack that paralysed its computer networks would cost the aluminium maker up to 450 million Norwegian crowns ($52 million) in the first quarter..."

https://uk.reuters.com/article/nors...ology, Media and Telecommunications)&&rpc=401

guest · Jun 5, 2019

mood said: ↑

Norsk Hydro's earnings delayed by five weeks due to March cyber attack
April 12, 2019
https://www.reuters.com/article/us-...eport-due-to-march-cyber-attack-idUSKCN1RO1YK
Click to expand...

Ransomware Attack Costs Norsk Hydro Tens of Millions of Dollars
June 5, 2019
https://www.securityweek.com/ransomware-attack-costs-norsk-hydro-tens-millions-dollars

The company on Tuesday published its financial report for the first quarter, which it was forced to delay by over one month due to the cyberattack. The report shows that its Extruded Solutions unit suffered the biggest operational and financial impact.
Hydro says the overall impact of the cyberattack in the first quarter remains $35-41 million. It estimates that losses will total $23-29 million (200-250 million Norwegian crowns) in the second quarter.

“Operations and sales have recovered successively during the quarter, reducing the incremental financial impact accordingly,” the company said. “Hydro has a robust cyber insurance in place with recognized insurers. Hydro has not yet recognized any insurance compensation. This will be recorded when deemed virtually certain.”
Click to expand...

hawki · Jul 23, 2019

"Norsk Hydro sees higher cost of cyber attack as second quarter lags

OSLO (Reuters) - Norsk Hydro, one of the world’s largest aluminum producers, said a cyber attack it sustained in March would cost it more than expected in the second quarter as it reported quarterly earnings that slightly lagged forecasts on Tuesday.

The cyber attack is now expected to cost 250-300 million crowns in the second quarter, compared with an earlier view that it would cost some 200-250 million crowns in that period.."

https://www.reuters.com/article/us-...r-attack-as-second-quarter-lags-idUSKCN1UI0HO

guest · Oct 29, 2019

Norsk Hydro's cyber insurance has paid just a fraction of its breach-related losses so far
October 28, 2019
https://www.cyberscoop.com/cyber-insurance-norsk-hydro-lockergoga-attack/

Norsk Hydro received an insurance payout of $3.6 million following a highly publicized cyberattack earlier this year, the company revealed in its third quarter earnings report.
The insurance payout represents about 6% of the $60 million to $71 million in costs created by the incident through the third quarter, the company said. The Norwegian aluminum and energy giant expects more compensation will come as more costs are totaled.

Norsk Hydro, which had a market capitalization of $12 billion last year, said after the attack in March that its policy, led by AIG, was “solid.”
Click to expand...

guest · Dec 18, 2019

Norsk Hydro responds to ransomware attack with transparency
December 17, 2019
https://www.microsoft.com/security/blog/2019/12/17/norsk-hydro-ransomware-attack-transparency/

Last March, aluminum supplier Norsk Hydro was attacked by LockerGoga, a form of ransomware. The attack began with an infected email and locked the files on thousands of servers and PCs. All 35,000 Norsk Hydro employees across 40 countries were affected.

Read Hackers hit Norsk Hydro with ransomware to learn why this approach helped the company recover and get back to business as usual.
Click to expand...

guest · Mar 17, 2020

Why the Norsk Hydro attack is a 'blueprint' for disruptive hacking operations
March 16, 2020
https://www.cyberscoop.com/norsk-hydro-lockergoga-ransomware/

It’s been a year since malicious code tore through the computer network of Norwegian aluminum giant Norsk Hydro, forcing the company to shift some of its operations to manual mode and inflicting tens of millions of dollars in damage.

Now, an investigation published Monday argues that the LockerGoga ransomware variant could have been designed to disrupt rather than to extort — to lock up the enterprise and throw away the key.

Regardless of who was behind the Norsk Hydro attack, it provides a “worryingly effective blueprint” for state-backed hackers to hide behind malware associated with criminals to achieve their goals, says Joe Slowik, adversary hunter at industrial cybersecurity company Dragos.
The Norsk Hydro attack “opens up a fuzzy space between something as blatantly obvious as a state-sponsored disruptive event like NotPetya, and the mass of criminal ransomware events that we see day in, and day out,” Slowik told CyberScoop.
Click to expand...

Dragos: Spyware Stealer Locker Wiper: LockerGoga Revisited

While superficially similar to other industrial-targeted ransomware events around the same time, the Hydro event incorporated unique disruptive characteristics calling into question whether the attackers ever intended to decrypt systems after infection.
Click to expand...

Log in or Sign up

Huge Norwegian aluminium plants hit by cyber-attack

ronjor Global Moderator

hawki Registered Member

hawki Registered Member

hawki Registered Member

ronjor Global Moderator

guest Guest

itman Registered Member

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

Huge Norwegian aluminium plants hit by cyber-attack

ronjor Global Moderator

hawki Registered Member

hawki Registered Member

hawki Registered Member

ronjor Global Moderator

guest Guest

itman Registered Member

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches