The end of 2018 has seen a major newspaper cyberattack take place in the United States that has disrupted production of several newspapers published by Tribune Publishing.

The attacks were malware-based and affected the Saturday editions of the Los Angeles Times, the San Diego Union-Tribune, the Chicago Tribune, the New York Times, the Wall Street Journal, and a number of others. The malware attack took place on Thursday, December 27, and caused major issues throughout Friday.

All of the impacted newspapers shared the same production platform, which was infiltrated by the malware infection. While the sort of malware used in the attack has not been publicly confirmed, several insiders at the Tribune have reported that the attack utilized Ryuk ransomware.

Ransomware is a type of malware that encrypts critical files stopping them from being accessed. The main goal of attackers is usually to obtain ransom payments in exchange for the keys to decrypt the encrypted files. It is also a regular occurrence for ransomware to be deployed after network access has been obtained and sensitive information has been stolen, either to mask a data breach or in an attempt to make an attack even more profitable. It is also not unknown for ransomware attacks to be carried out to cause disruption. It is thought that this newspaper cyberattack was conducted primarily to disable infrastructure.

The sort of ransomware used in an attack is usually easy to notice. After encrypting files, ransomware changes file extensions to an (often) unique extension. In this instance of Ryuk ransomware, extensions are changed to .ryk.

The Los Angeles Times has blamed threat actors based outside the United States, although it is  not clear which group was behind the cyberattacks. If the attack was carried out to disable infrastructure it is probable that this was a nation-state sponsored attack.

The first Ryuk ransomware cyberattacks took place in August. Three U.S. companies were attacked, and the attackers were paid a minimum of $640,000 for the keys to unlock the data. A review of the ransomware revealed it shared code with Hermes malware, which had previously been connected to the Lazarus Group – An APT group with links to North Korea.

While many ransomware campaigns utilized mass spamming tactics to spread the ransomware and infect as many end users as possible, the Ryuk ransomware attacks were much more targeted and involved major reconnaissance and extensive network mapping before the ransomware is finally deployed. As is the case with SamSam ransomware attacks, the campaign is carried out manually.

Several tactics are used to obtain access to networks, although earlier in 2018 a warning about Ryuk ransomware was issued by the U.S. Department of Health and Human Services (HHS) claiming email to be one of the main attack vectors, emphasising the importance of email security and end user training to help staff recognize email-based threats.