Cloud hosting provider Dataresolution.net is struggling to bring its systems back online after suffering a ransomware infestation on Christmas Eve, KrebsOnSecurity has learned. The company says its systems were hit by the Ryuk ransomware, the same malware strain that crippled printing and delivery operations for multiple major U.S. newspapers over the weekend.
San Juan Capistrano, Calif. based Data Resolution LLC serves some 30,000 businesses worldwide, offering software hosting, business continuity systems, cloud computing and data center services.
The company has not yet responded to requests for comment. But according to a status update shared by Data Resolution with affected customers on Dec. 29, 2018, the attackers broke in through a compromised login account on Christmas Eve and quickly began infecting servers with the Ryuk ransomware strain.
Part of an update on the outage shared with Data Resolution customers via Dropbox on Dec. 29, 2018.
The intrusion gave the attackers control of Data Resolution’s data center domain, briefly locking the company out of its own systems. The update sent to customers states that Data Resolution shut down its network to halt the spread of the infection and to work through the process of cleaning and restoring infected systems.
Data Resolution is assuring customers that there is no indication any data was stolen, and that the purpose of the attack was to extract payment from the company in exchange for a digital key that could be used to quickly unlock access to servers seized by the ransomware.
A snippet of an update that Data Resolution shared with affected customers on Dec. 31, 2018.
The Ryuk ransomware strain was first detailed in an August 2018 report by security firm CheckPoint, which says the malware may be tied to a sophisticated North Korean hacking team known as the Lazarus Group.
Ryuk reportedly was the same malware that infected the Los Angeles Times‘ Olympic printing plant over the weekend, an attack that led to the disruption of newspaper printing and delivery services for a number of publications that rely on the plant — including the Los Angeles Times and the San Diego Union Tribune.
A status update shared by Data Resolution with affected customers earlier today indicates the cloud hosting provider is still working to restore email access and multiple databases for clients. The update also said Data Resolution is in the process of restoring service for companies relying on it to host installations of Dynamics GP, a popular software package that many organizations use for accounting and payroll services.
A status update shared by Data Resolution with affected customers on Jan. 2, 2018 shows the company is still struggling to restore services more than a week after the attack began.
Cloud hosting providers are often pitched as a way for companies to increase security and to better protect themselves from threats like ransomware, which scrambles data on infected systems and demands payment in exchange for a digital key needed to unlock affected systems.
At the same time, cloud providers represent an especially attractive target for ransomware attacks because they store vast amounts of data for other companies. In 2017, cloud hosting provider Cloudnine was hit by a ransomware attack, leading to an outage that lasted for several days.
Much depends on security practices maintained by each provider, according to an MIT Technology Review story last year that named cloud ransomware attacks as a top security concern for 2018.
“The biggest cloud operators, like Google, Amazon, and IBM, have hired some of the brightest minds in digital security, so they won’t be easy to crack,” wrote Martin Giles. “But smaller companies are likely to be more vulnerable, and even a modest breach could lead to a big payday for the hackers involved.”
A source at a company that uses Data Resolution to manage payroll payments told KrebsOnSecurity that the cloud hosting provider said it did not attempt to pay the requested ransom, preferring to restore systems from backups instead.
We are one of Data Resolutions customers. We were locked out of our systems the day I came back from Christmas. No one at Data Resolution told us about the attack. When I called to find out why I was locked out, they said they would look into and get back to me. As a few hours went by with no response, I called them again, and within an hour or so, we were back up. Again, no one mentioned a word about why we went down. It was a 3rd party who reached out to me and told me about the ransom attack and they forwarded me a link to this article, and I was pissed off to say the least. I contacted Data Res and told them I was upset and complained because they didnt let us know, but they said they only alerted customers who were affected. That sounds very unprofessional to me. In fact, I thought it was odd that they dont require me to reset my passwords periodically. Isnt that security 101? Dont they have a responsibility to let all customers know what happened? Since this event happened their response time has increased, or they are non-responsive. We are currently looking at other providers because we dont feel like they handled things very well, and they should have more preventive measures in place considering they are hosting thousands of customer’s data…. they should be locked down like Ft. Knox….. this just shouldn’t happen.
Next, you need to go to the top right corner section of your computer screen to change the View by option. Select Large Icons from the drop-down list and that will change the orientation of the Control Panel options.
Most Linksys routers don’t require a restart for these DNS server changes to take effect, but be sure to do so if the router admin page asks you to.