Ransomware Attack on Norton Public Schools by LockBit: Impact and Details
Ransomware Attack on Norton Public Schools by LockBit
Overview of Norton Public Schools
Norton Public Schools, located in Norton, Massachusetts, is a public school district serving students from preschool through 12th grade. The district is dedicated to providing a rigorous and comprehensive educational experience aimed at nurturing the intellect of every student. With a mission to promote individual talents and maximize each student's potential, Norton Public Schools fosters a partnership with families and the community to prepare students for responsible global citizenship. The district employs between 201 and 500 individuals, indicating a medium-sized educational institution.
Details of the Ransomware Attack
On July 19, 2024, Norton Public Schools fell victim to a ransomware attack orchestrated by the notorious cybercriminal group LockBit. The attack targeted the district's official domain, norton.k12.ma.us. While the exact size of the data leak remains unknown, the incident underscores the growing threat of ransomware attacks on educational institutions. The attack has disrupted the district's operations, potentially compromising sensitive student and staff information.
About LockBit
LockBit, also known as LockBit Black, is a highly sophisticated ransomware-as-a-service (RaaS) group that has been active since September 2019. It has become the most active ransomware group, responsible for over one-third of all ransomware attacks in the latter half of 2022 and the first quarter of 2023. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files.
Penetration and Vulnerabilities
LockBit is designed to exploit vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. It performs a check to avoid executing on computer systems with installed languages common to the Commonwealth of Independent States (CIS) region. The ransomware group distinguishes itself by its modular design, which encrypts its payload until execution to hinder malware analysis and detection. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) when executed, the use of a unique icon, and changes to the victim's computer wallpaper.
Impact on Norton Public Schools
The ransomware attack on Norton Public Schools highlights the vulnerabilities educational institutions face in the digital age. The district's commitment to technology and innovation, while beneficial for educational purposes, also makes it a target for cybercriminals. The attack has likely disrupted the district's operations, affecting both academic and support services. The incident serves as a stark reminder of the importance of robust cybersecurity measures in protecting sensitive information and ensuring the continuity of educational services.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!