City of Dallas Ransomware Incident Report

The following is my synopsis of an excellent report from the City of Dallas ITS Risk Management on a significant ransomware attack this year. In contrast, most such incidents involve private entities with buried analyses that are heard through the grapevine. The rest of the article breaks down the phases of the spread. Please note all sections below are taken verbatim from their report.

Threat Actor: Royal

Statistics

In the year 2022, ransomware victimized over 70 percent of organizations, marking a surge compared to the preceding five years and establishing the highest recorded proportion to date. The incidence of ransomware exhibited a noteworthy annual growth rate of 13% during 2022, surpassing the cumulative increase of the preceding five years. Furthermore, the number of public ransomware victims escalated by 38% when compared to the initial quarter of 2023 and demonstrated an astounding 100% surge from the second quarter of 2022. This denotes a substantial 75 percent upswing in the mean count of monthly attacks in the United States between the initial and latter halves of the preceding 12-month period.

Spread Phase

The initial entry point was established through the utilization of [a] service account that connected to a server. Leveraging this initial access, the threat actor cleverly navigated the internal infrastructure of the City by exploiting legitimate third-party remote management utilities. The Royal group constructed what is typically known as “Beacons” using remote management utilities and legitimate pen-testing technologies to traverse the City’s internal network. These actions provided staging for Royal to exfiltrate an estimated 1.169 TB of data through the initial impacted server. In addition to data exfiltration, the Threat Actor’s credential harvesting techniques provided a list of users, accounts, and devices.