The recently dismantled NetWalker ransomware platform was responsible for the cyberattack that paralyzed the servers of the City of Montmagny last January.
It was early in the morning of January 17, while trying to handle snow removal operations, that employees noticed the city’s computers were no longer responding. Criminals associated with the NetWalker group had encrypted their data and were demanding a ransom to recover it.
The outage affected the telephone and computer systems of the city, the library and the Société de développement économique de Montmagny. The use of externally hosted services and redundancies allowed the controllers of the water treatment management system and the emergency telephone system to remain operational.
Data recovered without a ransom
Reached by phone, Mr. Félix Michaud, Director General of the City of Montmagny, says the city has recovered the stolen data. “A new secure architecture” will be up and running in a few days. “We were lucky in our misfortune,” since the authorities dismantled NetWalker ten days after this attack.
The data systems will be restored without loss and without any ransom being paid. Mr. Michaud cannot say how the data was recovered, because the experts “don’t reveal the secret ingredients of their recipes,” but it does not appear that the hackers made copies. The experts are keeping watch to see whether this data resurfaces.
NetWalker, a turnkey service
Netwalker was a platform that allowed “affiliates” to rent its services to carry out ransomware attacks. The affiliate finds vulnerable computer systems and deploys the software maintained by the platform’s “developers.” This group had adopted the “double extortion” strategy. In addition to encrypting the data, the group would publish a sample of it and threaten to make everything public in order to force its victims to pay the ransom. The profits are then shared between the affiliate and the developers.
On January 27, the United States Department of Justice announced the arrest of a 33-year-old man living in Gatineau, Sébastien Vachon-Desjardins, in connection with the dismantling of the NetWalker network. According to an article published by the firm chainalysis, he is allegedly responsible for 91 attacks since April 2020. The same week, Bulgarian authorities seized a server hosting a “dark web” site used to communicate with victims and give them payment instructions.
Montmagny’s IT services will be restored within a few days. Mr. Michaud hopes that talking about their experience will help raise awareness among other organizations and businesses of the risks posed by this type of attack. He points out that the city managed to keep providing the necessary services thanks to the staff’s creativity, and that “in adversity, it helps forge closer ties between team members.”
