Ransomware spree hitting European oil, transport companies

European officials do not currently believe that some of the attacks are linked.

European oil and transportation services have spent all week under attack by ransomware.

The latest victim, aviation services company Swissport, announced Friday that ransomware struck part of its IT infrastructure, causing flight delays and knocking its website offline. The company said last month that in 2019, it fueled 2.3 million flights, and claims 2,000 employees at 40 airports across six countries.

The announcement comes one day after reports of attacks on oil port terminals in Belgium and the Netherlands. Earlier this week, two German oil companies became ransomware victims as well, forcing one of the companies into operating at a limited capacity and prompting Shell to reroute oil supplies.

Although those two attacks prompted speculation about Russian government involvement at a time when Germany is considering pulling out of a gas pipeline deal with Russia over its aggression against Ukraine, European officials said they don’t currently believe the attacks in Belgium, Germany or Netherlands are connected.

Germany’s Federal Office for Information Security blamed BlackCat for the attacks in its country, and a European official told The Record that the port attacks were associated with the BlackCat and Conti ransomware families, both of which researchers have traced to Russia.

BlackCat ransomware has quickly made a name for itself. Analysts have observed connections between BlackCat and other big-name ransomware groups like REvil and Darkside. A representative of the BlackCat gang told Recorded Future that it was, in fact, linked to several ransomware groups because they were affiliates — although ransomware operatives, like many cybercriminals, are prone to deception and exaggeration.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure