HYDERABAD: Investigators suspect an international cybercrime group was behind the ransomware attack on TG-iPASS, Telangana’s single-window platform for industrial clearances. An email address left behind by the hackers has pointed to a possible link with Turkey.The attack, which took place on the night of the 22nd of last month, encrypted critical data belonging to 28,000 companies and information relating to another 7,000 organisations that had applied for trade licence renewals.However, a team of experts from the industries department managed to decrypt the data, restoring access to the information.Hackers target server in late-night attackTG-iPASS provides approvals and clearances from various government departments for setting up industries in Telangana.The crucial portal suddenly stopped functioning on the night of the 22nd of last month. As the application database failed to connect to the server, officials initially suspected a technical problem.They contacted the company providing hosting services for the portal and restarted the server. However, the problem persisted.Further investigation revealed that the SQL Server Agent service had stopped functioning. Attempts to restart it also failed.A detailed examination subsequently revealed that hackers had breached the server’s security and encrypted the database and other critical files.The affected files had an unfamiliar ‘VGB’ extension appended to their names. Investigators also found a ransom note on the server containing an email address and a machine ID for communication with the hackers.Officials then confirmed that the incident was not an ordinary technical malfunction but a ransomware attack.VGB extension does not identify the malwareCybersecurity experts say ‘VGB’ is not the name of a specific virus. It is merely a file extension added by hackers after encrypting files on a computer.Ordinarily, photographs have the JPG extension, PDF documents use PDF, and Word documents carry extensions such as .DOCX.Similarly, ransomware operators often append specific extensions to encrypted files to identify them.However, the presence of the VGB extension alone cannot establish which malware was used in the attack.Experts say the actual nature of the malware can be determined only after analysing its code, encryption method, file samples, ransom note and server logs.Email trail points to Turkey, but hackers’ location remains unclearCyber experts examined the email details left behind by the hackers. Investigators found indications of a possible connection with Turkey.However, officials say an email address or its technical details alone cannot establish the actual location of the criminals.Investigators will also have to examine whether the hackers used virtual private networks (VPNs), proxy servers, servers located in other countries or temporary email accounts to conceal their identities.The actual operators will have to be identified through internet protocol (IP) addresses used in the attack, domain details, server logs and other digital evidence. The investigation is proceeding along these lines.Ransomware groups generally encrypt an organisation’s data and demand large sums of money to restore access.In the TG-iPASS incident, however, the hackers did not specify any ransom amount. They left behind only an email address for communication.Industries department strengthens firewalls and backup securityThe industries department is strengthening its cybersecurity systems to prevent similar attacks.It is focusing on installing additional firewalls and improving server security and application infrastructure.Officials also conducted security tests before restoring the portal to full functionality.Although the recovery of TG-iPASS data has removed the immediate threat, several questions remain unanswered.Who is behind the network indicated by the Turkey link? How secure is the information belonging to 35,000 organisations?Investigators are expected to establish the answers through the ongoing probe.
Click Here For The Original Source.
——————————————————–
