City of Atlanta

The city of Atlanta's government has apparently become the victim of a ransomware attack.

Its official Twitter account announced that the city government "is currently experiencing outages on various customer-facing applications, including some that customers may use to pay bills or access court-related information."

A city employee sent the station a screenshot of a ransomware message demanding a payment of $6,800 to unlock each computer or $51,000 to provide all the keys for affected systems.

An internal email shared with WXIA said that the internal systems affected include the city's payroll application.

Based on the screenshot, one security expert WXIA showed it to said that it resembled the message from a variant of Samsam, a family of ransomware that struck a number of hospitals two years ago.

Those malware attacks exploited a Java de-serialization vulnerability in Java-based application servers.

But it's not clear that the Atlanta outbreak started in the same way.

Source: https://arstechnica.com/information-technology/2018/03/atlanta-city-government-systems-down-due-to-ransomware-attack/

TPRM report: https://www.rankiteo.com/company/city-of-atlanta

"id": "cit1129622",
"linkid": "city-of-atlanta",
"type": "Ransomware",
"date": "6/2017",
"severity": "75",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': 'Public Sector',
                        'location': 'Atlanta, Georgia',
                        'name': 'City of Atlanta',
                        'type': 'Government'}],
 'description': "The city of Atlanta's government experienced a ransomware "
                'attack affecting various customer-facing applications, '
                'including bill payment and court-related information systems.',
 'impact': {'operational_impact': 'Outages on various customer-facing '
                                  'applications',
            'systems_affected': ['Customer-facing applications',
                                 'Payroll application']},
 'motivation': 'Financial Gain',
 'ransomware': {'ransom_demanded': ['$6,800 per computer',
                                    '$51,000 for all keys'],
                'ransomware_strain': 'Samsam variant'},
 'references': [{'source': 'WXIA'}],
 'response': {'communication_strategy': 'Public announcement via Twitter'},
 'title': 'Ransomware Attack on City of Atlanta',
 'type': 'Ransomware'}