SAN ANTONIO – After Uvalde Consolidated Independent School District canceled most classes this week because of a ransomware attack, the FBI says the crime is one of the fastest-growing threats the agency investigates.
“The threat of ransomware is constantly growing and evolving,” said Supervisory Special Agent Justin Akers of the FBI’s Cyber Squad. “It is a very significant threat and it’s a priority for the FBI.”
Ransomware attacks, which encrypt a victim’s data and demand payment for its release, can target schools, businesses or individuals. Akers said the actual losses are difficult to calculate because many attacks go unreported.
Over the past several years, the FBI has tracked down individuals responsible for major cyberattacks. In one case, Ukrainian national Mark Sokolovsky was sentenced last year to five years in federal prison for conspiring to operate a program that stole data and cryptocurrency from victims, including some in San Antonio.
But investigators often face obstacles, Akers said, because many perpetrators operate in countries that do not cooperate with the United States on cybercrime, such as Russia, North Korea and Iran.
“These criminal actors are savvy,” Akers said. “They get better at hiding their identity and hiding the infrastructure they use to perpetrate these crimes.”
The FBI is focused on dismantling the ecosystem that enables ransomware, including the financial networks that allow attackers to profit.
“The main motivating factor for these groups behind the ransomware attacks is money,” Akers said.
Agents also stress the importance of prevention.
“Be skeptical of what you download,” Akers said. “You’ve got to think before you click that link. If everybody in the organization practices good cyber hygiene, it’s going to make it much more difficult for the bad actors to get on the network.”
The bureau advises victims not to pay ransom and to instead report attacks to ic3.gov and their local FBI field office.
Special Agent in charge of the FBI San Antonio Field Office Aaron Tapp also provided this statement about ransomware attacks.
“The FBI’s mission is to prevent ransomware attacks through education and awareness, but once an attack has occurred, our primary role becomes investigative. We collect and process evidence, identify malware variants, and seek attribution of ransomware actors to ultimately bring them to justice. Thoughtful investigations allow us to identify patterns and understand the adversary’s tactics. The lessons we learn can then be shared with our private sector partners in hopes of preventing future attacks. In the fight against increasingly savvy criminals, the FBI relies on you. Without the information you report to us through ic3.gov or your local FBI Field Office, we simply cannot piece together the puzzle of this ever-shifting threat landscape.”
As for Uvalde CISD, district officials said Monday night that the FBI and other agencies are still investigating the attack while slowly restoring internal systems. Classes are expected to resume Friday.
Read also: