Weiz es una villa austriaca, rodeada de naturaleza y que no sabrías decir si es un pueblo o una ciudad. Todo era muy tranquilo hasta la llegada de NetWalker.
Los servicios públicos de esta localidad austriaca han sido víctimas de un ataque de ransomware perpetrado por el grupo NetWalker. A pesar de que todavía hay muchos datos que se desconocen con respecto a este ataque, se conoce que el objetivo comprometido es la red de sistemas de servicios públicos de la localidad.
Existen muchos indicios que apuntan a que la vía de entrada de NetWalker en la red ha sido una campaña de phishing, más concretamente mensajes de correo electrónico supuestamente relacionados con el COVID-19, Without a doubt, the star lure for cybercriminals since the coronavirus entered our lives.
As proof of the success of the attack, NetWalker operators have carried out an initial data leak corresponding to some of the public services of Weiz.
Since this malware is capable of self-replicating on all Windows systems connected to the network, as well as detecting and deleting backup copies of encrypted and exfiltrated data, it can be assumed that the volume of information in the hands of cybercriminals must be unusually high, and that the operation of Weiz's public services is likely being seriously compromised.
The town of Weiz is considered the economic center of the Oststeiermark region and is located near the city of Graz. Several important companies, such as the car supplier Magna and the construction companies Strobl Construction and LIEB-Bau-Weiz, have production sites in Weiz.
The combination of a small municipality (around 10.000 inhabitants) having so much weight in the region, suggests that NetWalker's action was not accidental, but rather we are talking about a targeted attack with a very specific objective. It is likely that many services of the municipal IT infrastructure share several elements. It is a mistake, even when we are talking about small infrastructures, not to segment (and even isolate, if necessary) redes, services, etc… And it is that, otherwise, a successful attack on a single computer can, as in this case, secuestrar una ciudad entera.