Daily Current Affairs

Ransomware Attack Disrupts Bank Operations (GS Paper 3, Cyber Security)

Introduction

• On August 2, 2024, a severe ransomware attack disrupted operations across at least 150-200 cooperative banks and Regional Rural Banks (RRBs) in India.
• The attack primarily impacted banks serviced by C-Edge Technologies Ltd., a joint venture between Tata Consultancy Services Ltd. (TCS) and State Bank of India (SBI).
• This incident highlights critical vulnerabilities in the financial sector and underscores the need for enhanced cybersecurity measures.

 

Impact of the Ransomware Attack

Affected Banks

The ransomware attack targeted C-Edge Technologies Ltd., impacting their ability to provide essential services to cooperative banks and RRBs. Key areas affected include:

• Payment Systems: Customers of the affected banks were unable to access Unified Payments Interface (UPI) and Aadhaar-enabled payment systems (AePS).
• Operational Disruptions: Some RRBs, depending on their sponsor banks, continued operations normally due to alternative technology service providers.

 

Broader Implications

The attack underscores the critical role of technology service providers in maintaining payment infrastructure. The broader implications include:

• Vulnerability of Payment Ecosystem: The incident highlights vulnerabilities in the technology service providers that support the banking infrastructure.
• Need for Robust Cybersecurity Measures: The attack emphasizes the necessity for strong cybersecurity protocols to prevent such disruptions in the future.
• Collaboration for Mitigation: Effective response requires cooperation between NPCI, banks, and technology providers to address and mitigate the impacts of such disruptions.

 

Understanding Ransomware

Definition and Evolution

Ransomware is a type of malware that encrypts a victim’s data or locks their device, demanding a ransom for the decryption key or to regain access. Over time, ransomware tactics have evolved from simple encryption to more complex schemes:

• Double-Extortion: Attackers threaten to leak stolen data if the ransom is not paid.
• Triple-Extortion: Attackers use stolen data to target the victim's customers or business partners.

 

Types of Ransomware

• Encrypting Ransomware (Crypto Ransomware): Encrypts data, demanding ransom for the decryption key.
• Non-encrypting Ransomware (Screen-locking Ransomware): Locks the device and displays a ransom demand.
• Subcategories:

• Leakware/Doxware: Steals and threatens to publish sensitive data.
• Mobile Ransomware: Affects mobile devices.
• Wipers: Threaten to destroy data.
• Scareware: Uses fear tactics to coerce payment.

 

Ransomware as a Cyber Threat

• Financial Impact: Ransomware attacks can cost organizations millions. An IBM report indicates the average cost of a data breach in 2024 reached Rs 19.5 crore (USD 2.35 million), up by 7% from 2023.
• Speed of Attacks: Ransomware can be deployed in less than four days, leaving organizations with limited time to respond.

 

Response Strategies

• Isolate Infected Devices: Disconnect affected devices to contain the spread of infection.
• Identify Entry Points: Use monitoring platforms to find the initial point of entry and scan encrypted files and ransom notes.
• Restore Systems: Prioritize restoring critical systems from backups and attempt decryption if backups are not available.

 

How Ransomware Infects Systems

• Phishing: Deceptive tactics to trick victims into downloading ransomware via malicious attachments or links.
• Exploiting Vulnerabilities: Utilizing existing or zero-day vulnerabilities to deploy ransomware.
• Credential Theft: Stealing user credentials to access and deploy ransomware.
• Other Malware: Using Trojans or other malware to spread ransomware.
• Drive-by Downloads: Compromised websites that infect devices.
• Ransomware as a Service (RaaS): Allows criminals to use ransomware developed by others.

 

Notable Ransomware Variants

• Akira Ransomware
• LockBit Ransomware
• CryptoLocker: Kick-started modern ransomware attacks in 2013.
• WannaCry: Affected over 200,000 computers in 2017.
• Petya/NotPetya: Rendered computers unable to boot.
• Ryuk: Targeted high-value victims.
• DarkSide: Responsible for the Colonial Pipeline attack in 2021.
• Locky: Used email macros to infect devices.
• REvil: Known for double-extortion attacks.
• Conti: Operated a RaaS scheme with double-extortion tactics.

 

Legislations to Protect Against Ransomware Attacks in India

Relevant Legal Framework

Ransomware attacks are addressed under various Indian laws:

Indian Penal Code (IPC), 1860

• Information Technology (IT) Act, 2000: Includes provisions like Section 43 and 66 (damage to computer/system), Section 65 (tampering with computer source documents), and Section 66D (cheating by personation). The punishment can range from three to seven years imprisonment and fines up to Rs. 1 crore.

 

Ransomware Task Force (RTF)

• The RTF, part of India’s National Cyber Security Coordinator (NCSC), assists victims with investigation, recovery, and prevention efforts.

 

Cybersecurity Framework for Indian Banking Sector, 2018

Issued by the RBI, it mandates:

• Robust Cybersecurity Measures: Multi-factor authentication, encryption, and regular security audits.

 

Way Forward

Cybersecurity Enhancements

• Implement Robust Measures: Banks and technology providers should enhance endpoint protection, network security, data backup, and employee training.
• Threat Detection and Prevention: Improved methods have led to an 11.5% decline in ransomware infections from 2022 to 2023.
• Centralized Threat Intelligence: Establish a platform for sharing threat intelligence among financial institutions.

 

Data Backup and Recovery

• Develop Comprehensive Plans: Implement offline backups and business continuity plans to ensure minimal disruption during cyberattacks.

 

Enhanced Security Standards

• Third-party Assessments: Conduct rigorous security assessments of vendors and improve incident response capabilities.
• Obtain Cybersecurity Certifications: Demonstrate a commitment to maintaining high-security standards.

 

Conclusion

• The recent ransomware attack on cooperative banks and RRBs highlights significant vulnerabilities in the financial sector's technology infrastructure.
• It underscores the urgent need for enhanced cybersecurity measures, robust response strategies, and improved legislative frameworks to protect against future attacks.