Ransomware as a Disruptive Weapon: LockerGoga and the Norsk Hydro Incident
Dragos: ICS Cybersecurity via YouTube
Overview
Syllabus
Intro
Origins
WHOAMI
Agenda
Ransomware Defined
Older than You Think
Ransomware Evolution
Major Shifts in Behavior
LockerGoga Behavior
LockerGoga Sequencing
LockerGoga Intrusion
Assessment: Ransomware
Norsk Hydro Incident
LockerGoga at Hydro
Initial Suspicions
Curious Functionality
Odd Timing
Different Intrusion Path
LockerGoga & FING
Related Events?
Coordinated Event?
And Then...
LockerGoga "Development"
LockerGoga Timeline
Intention and Purpose
Ransomware as Wiper
NotPetya as Wiper
NotPetya Failures
Revising NotPetya
Ransomware as Cyberweapon
Benefit of Ransomware-Wiper
Impacts on Reporting, Sharing
Reporting & State Intervention
Insurance and Incentives
Limitations of Method
Defense and Detection
References & Resources
White Paper Link
Taught by
Dragos: ICS Cybersecurity