Basic Description: malicious software, includes various harmful programs such as viruses, worms, Trojans, ransomware, adware, spyware, rootkits, keyloggers, fileless malware, and cryptojacking. These programs are designed to damage, disrupt, or gain unauthorized access to computer systems by exploiting vulnerabilities and using tactics like phishing to spread through emails and infected websites.
In February 2023, Dish Network suffered a significant ransomware attack that led to widespread service disruptions and data breaches affecting nearly 300,000 individuals. The attack compromised employee-related records and personal information, including driver's license numbers and health insurance details. Dish Network experienced prolonged outages across its services, websites, and call centers. Although the company did not confirm paying a ransom, it received confirmation that the extracted data was deleted, suggesting a potential ransom payment. This incident underscores the vulnerabilities in corporate IT infrastructure and the severe impacts of ransomware on service continuity and data security
https://techcrunch.com/2023/05/22/dish-says-ransomware-gang-stole-almost-300000-employee-records/
In May 2021, the Colonial Pipeline Company, which operates one of the largest fuel pipelines in the United States, was targeted by a ransomware group known as DarkSide. The attack forced the company to shut down its operations, leading to widespread fuel shortages and a spike in gas prices across the southeastern U.S. To regain control of its systems, Colonial Pipeline paid a ransom of approximately $4.4 million. This incident highlighted the vulnerabilities in critical infrastructure and underscored the urgent need for robust cybersecurity measures to protect such essential services
https://xygeni.io/blog/the-most-infamous-malware-attacks-in-history/
Similarities:
Both attacks involved ransomware that encrypted data and demanded a ransom for decryption.
Each incident underscored significant vulnerabilities in cybersecurity practices and highlighted the need for improved defenses.
Differences:
WannaCry spread globally and affected a wide range of sectors, while the Colonial Pipeline attack was more targeted, focusing on critical infrastructure.
The method of spread differed: WannaCry used a known vulnerability to propagate quickly, whereas the Colonial Pipeline attack was a direct, targeted assault by a specific group.
Build A Network Activity:
In the "Build a Network" classroom activity, where teams used strings to simulate network connections, malware could be introduced by one participant acting as a malicious actor who attaches a "malicious" string to another's. As participants exchange strings to form connections, the malware spreads, simulating how it propagates through a network by exploiting connections and vulnerabilities, such as outdated software. This disrupts network functionality, illustrating the impact of malware. Participants can also simulate defense mechanisms by "cutting" infected strings or designating "firewalls" to block certain connections, demonstrating how cybersecurity measures can contain and mitigate malware spread.