ISS World “malware attack” leaves employees offline

guest · Feb 20, 2020

ISS World “malware attack” leaves employees offline
February 20, 2020
https://nakedsecurity.sophos.com/2020/02/20/iss-world-malware-attack-leaves-employees-offline/

Global facilities company ISS World, headquartered in Denmark, has shuttered most of its computer systems worldwide after suffering what it describes as a “security incident impacting parts of the IT environment.”

The company’s website currently shows a holding page, with no clickable links on it:

On 17 February 2020, ISS was the target of a malware attack. As a precautionary measure and as part of our standard operating procedure, we immediately disabled access to shared IT services across our sites and countries, which ensured the isolation of the incident. [...]
Some media outlets – for example, the BBC – have mentioned ransomware prominently in their coverage of the issue, perhaps because of the suddenness of the story, but at the moment we simply don’t know what sort of malware was involved.

Nevertheless, a report in the UK claims that 43,000 staff worldwide, including 4000 in the UK, don’t have access to email, a serious operational blow to any modern business.
Click to expand...

Two things right
As bad as it sounds, it seems that the company has done at least two things right: it has issued a clear statement of what it’s willing to say right now, and it has stated that it will tell us all more when it is sure of its facts.
Click to expand...

guest · Feb 21, 2020

Facilities Maintenance Firm Recovering From Malware Attack
ISS World Says 'Root Cause' Has Been Identified
February 21, 2020
https://www.inforisktoday.com/facilities-maintenance-firm-recovering-from-malware-attack-a-13747

ISS World, a global facilities maintenance company based in Denmark, says it's gradually restoring its systems after a malware attack on Monday.

ISS World says the "root cause" of the attack has been identified. But the company didn't say if the attack was caused by ransomware, the file-encrypting malware that is frequently the cause of public announcements of system shutdowns.
U.K.-based security researcher Kevin Beaumont tweeted on Thursday, however, that ISS World has "informed business partners it is ransomware."

"Certain systems have already been restored," the company says in a statement. "There is no indication that any customer data has been compromised."
Beaumont tweets that it's possible ISS World was affected by the REvil ransomware, also known as Sodinokibi [...]
Click to expand...

Their Citrix server, https://t.co/xDR6wqp0wj, was vulnerable to CVE-2019-19781 on January 11th.
This critical vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the targeted server (https://t.co/Ba1muwe7ny). https://t.co/Z2nnKfdB69
— Bad Packets Report (@bad_packets) February 19, 2020
Click to expand...

Log in or Sign up

ISS World “malware attack” leaves employees offline

guest Guest

guest Guest

Log in or Sign up

ISS World “malware attack” leaves employees offline

guest Guest

guest Guest

Useful Searches