A China-linked ransomware group, Warlock, disabled security tools at a critical infrastructure operator before launching its encryptor, highlighting a previously unaccounted-for risk in security budgets.
The vulnerability or weakness
The attackers used a tool to disable security software, which was recorded on 40 hosts within about two hours, averaging one machine losing protection every three minutes.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This incident demonstrates the need for constant security vigilance, as disabling security tools can lead to rapid data encryption, causing significant business disruption and potential financial losses.
Industries affected
Critical infrastructure, water utilities, telecommunications, and regional government bodies are affected.
Users affected
Customers and users of the affected critical infrastructure services may experience service disruptions and potential data loss.
