Govt. Services Firm Tyler Technologies Hit in Apparent Ransomware Attack

guest · Sep 23, 2020

Govt. Services Firm Tyler Technologies Hit in Apparent Ransomware Attack
September 23, 2020
https://krebsonsecurity.com/2020/09...chnologies-hit-in-apparent-ransomware-attack/

Tyler Technologies, a Texas-based company that bills itself as the largest provider of software and technology services to the United States public sector, is battling a network intrusion that has disrupted its operations. The company declined to discuss the exact cause of the disruption, but their response so far is straight out of the playbook for responding to ransomware incidents.

Plano, Texas-based Tyler Technologies [NYSE:TYL] has some 5,300 employees and brought in revenues of more than $1 billion in 2019.
Earlier today, the normal content on tylertech.com was replaced with a notice saying the site was offline. In a statement provided to KrebsOnSecurity after the markets closed central time, Tyler Tech said early this morning the company became aware that an unauthorized intruder had gained access to its phone and information technology systems.

“We currently have no reason to believe that any client data, client servers, or hosted systems were affected.”
Click to expand...

Tyler Technologies declined to say how the intrusion is affecting its customers. But several readers who work in IT roles at local government systems that rely on Tyler Tech said the outage had disrupted the ability of people to pay their water bills or court payments.

“Tyler has access to a lot of these servers in cities and counties for remote support, so it was very thoughtful of them to keep everyone in the dark and possibly exposed if the attackers made off with remote support credentials while waiting for the stock market to close,” said one reader who asked to remain anonymous.
Click to expand...

Tyler Tech has pivoted on the threat of ransomware as a selling point for many of its services, using its presence on social media to promote ransomware survival guides and incident response checklists.
With any luck, the company was following some of its own advice and will weather this storm quickly.
Click to expand...

guest · Sep 24, 2020

RansomExx ransomware
Government software provider Tyler Technologies hit by ransomware
september 23, 2020
https://www.bleepingcomputer.com/ne...rovider-tyler-technologies-hit-by-ransomware/

Tyler technologies hit by RansomExx ransomware
Cybersecurity sources familiar with the attack told BleepingComputer that Tyler Technologies suffered an attack by the RansomExx ransomware.
RansomExx is a rebranded version of the Defray777 ransomware and has seen increased activity since June when they attacked the Texas Department of Transportation (TxDOT), Konica Minolta, and most recently IPG Photonics.

While BleepingComputer has not obtained the ransom note, we found an encrypted file uploaded to VirusTotal today related to this attack.
This encrypted file has an extension of '.tylertech911-f1e1a2ac,' which includes Tyler Technologies' name and is the same format used in other RansomExx attacks.
Click to expand...

BleepingComputer has contacted Tyler Technologies with further questions but has not received a response.
Click to expand...

guest · Sep 25, 2020

Hacked software provider acknowledges ransomware attack
September 25, 2020
https://apnews.com/article/dallas-t...king-archive-0ccdcb35696b7bda696caf487fafb8f2

A major U.S. provider of software services to state and local governments acknowledged Friday it was hit by a ransomware attack two days after telling clients an unknown intruder had compromised its phone and information technology systems.

Tyler Technologies said in a statement that it confirmed the intruder used ransomware but did not provide further details on its response, citing an ongoing investigation. A spokesperson for the Dallas-area company did not directly answer a question about whether it had paid to have its systems unlocked.
The FBI has declined to comment on the breach.

Some governments also use one of its platforms to post election data online, although that use appears limited and Tyler has said data for that software is hosted on Amazon Web Services, not on the network that was hacked.
Click to expand...

mood said: ↑

Govt. Services Firm Tyler Technologies Hit in Apparent Ransomware Attack September 23, 2020
Click to expand...

Updated article (September 24, 2020):

Update, Sept. 24, 6:00 p.m. ET: Tyler said in an updated statement on its website that a review of its logs, monitoring, traffic reports and cases related to utility and court payments revealed no outages with those systems.

However, several sources interviewed for this story who work in tech roles at local governments which rely on Tyler Tech said they proactively severed their connections to Tyler Tech systems after learning about the intrusion.
This is a fairly typical response for companies that outsource payment transactions to a third party when and that third party ends up experiencing a ransomware attack, but the end result (citizens unable to make payments) is the same.
Click to expand...

guest · Sep 26, 2020

Tyler Technologies warns clients to change remote support passwords
September 26, 2020
https://www.bleepingcomputer.com/ne...s-clients-to-change-remote-support-passwords/

Tyler Technologies is warning clients to change the passwords for the technology provider's remote access accounts after suspicious logins have been reported.

This attack was performed by the RansomExx/Defray777 operation, who encrypted the company's devices and disrupted operations.
Remote support accounts used in suspicious logins
In an email sent late last night from Tyler Technologies and seen by BleepingComputer, CIO Matt Bieri is warning customers that "Tyler credentials" used for remote access were reported as being used to perform suspicious logins.

It is not known if these reports of suspicious activity are related to the recent ransomware attack, but to be safe, they are advising their clients to change all passwords for accounts used by Tyler Technologies.
Click to expand...

Could attackers have access to client's networks?
While spreading laterally, the attackers will also peruse victim's files and steal unencrypted data. This data is then analyzed for sensitive information to be used as leverage to get a victim to pay the ransom.
Some of this information could be saved login credentials in VPN clients or even a spreadsheet that contains account credentials for remote access to client's networks.

To be safe, all customers should immediately change the passwords to any accounts used by Tyler Technologies' staff to access their network.
Click to expand...

zapjb · Sep 26, 2020

I blame these huge corps & gov entities for having weak & underfunded IT departments. And don't be fooled 90%+ pay the ransom.

guest · Oct 10, 2020

Tyler Technologies paid ransomware gang for decryption key
October 10, 2020
https://www.bleepingcomputer.com/ne...gies-paid-ransomware-gang-for-decryption-key/

Tyler Technologies has paid a ransom for a decryption key to recover files encrypted in a recent ransomware attack.

Sources in the public sector have told BleepingComputer that the ransomware attack severely impacted Tyler Technologies and that the company expected it would take thirty days to recover operations fully.
Paid ransom to obtain a decryptor
A source told BleepingComputer that Tyler Technologies paid the RansomExx ransom demand to recover encrypted data.
It is not unknown, though, how much was paid to receive a decryption key.
Click to expand...

When asked about the decryptor, Tyler Technologies did not dispute the ransom payment, but told BleepingComputer that they could not disclose any further information at this time.

"Given the sensitivities around the incident and our investigation of it, and our active cooperation with law enforcement, we are not at liberty to disclose additional details at this time."
Click to expand...

guest · Nov 6, 2020

Tyler Technologies Lost $4 Million In Sales Due To Ransomware Attack
November 6, 2020
https://www.crn.com/news/channel-pr...t-4-million-in-sales-due-to-ransomware-attack

Tyler Technologies said the ransomware attack on the company’s network last month caused a $4 million hit to sales, but it does appear that Tyler was able to keep the malware out of its other systems, CEO H. Lynn Moore told investors during an earnings call this week.

“The security incident did impact our ability to deliver licenses and services during late September and into October,” Moore said.
“We currently estimate the impact to revenue was approximately $1.5 million in the third quarter and $2.5 million in the fourth quarter. We maintained cybersecurity insurance coverage in amount that we believe is adequate.”
“There has been no evidence of compromise in the separate and segregated environments where we host software for our clients,” Moore said.
Click to expand...

From the moment of the attack, Tyler’s own security team was assisted by cybersecurity vendors as well as law enforcement, Moore said. Notably, Mandiant FireEye was called in to help mitigate the damage.

Tyler hardened its network security following the intrusion and Moore said it is working with law enforcement. “Tyler has also taken steps to supplement the existing multilayered security monitoring, scanning and antivirus protocols already in place,” he said.
“We are committed to completing our full forensics investigation and taking all appropriate actions in response to our findings.”
Click to expand...

Log in or Sign up

Govt. Services Firm Tyler Technologies Hit in Apparent Ransomware Attack

guest Guest

guest Guest

guest Guest

guest Guest

zapjb Registered Member

guest Guest

guest Guest

Log in or Sign up

Govt. Services Firm Tyler Technologies Hit in Apparent Ransomware Attack

guest Guest

guest Guest

guest Guest

guest Guest

zapjb Registered Member

guest Guest

guest Guest

Useful Searches