For over a week, the City of Atlanta has battled a ransomware attack that has caused serious digital disruptions in five of the city's 13 local government departments. The attack has had far-reaching impacts—crippling the court system, keeping residents from paying their water bills, limiting vital communications like sewer infrastructure requests, and pushing the Atlanta Police Department to file paper reports for days. It's been a devastating barrage—all caused by a standard, but notoriously effective strain of ransomware called SamSam.
"It’s important to understand that our overall operations have been significantly impacted and it will take some time to work through and rebuild our systems and infrastructure," a spokesperson for the City of Atlanta said in a statement on Thursday.
Atlanta faces a tough opponent in cleaning up this mess. While dozens of serviceable ransomware programs circulate at any given time, SamSam and the attackers who deploy it are particularly known for clever, high-yield approaches. The specific malware and attackers—combined with what analysts see as lack of preparedness, based on the extent of the downtime—explain why the Atlanta infection has been so debilitating.
First identified in 2015, SamSam's advantages are conceptual as well as technical, and hackers make hundreds of thousands, even millions of dollars a year by launching SamSam attacks. Unlike many ransomware variants that spread through phishing or online scams and require an individual to inadvertently run a malicious program on a PC (which can then start a chain reaction across a network), SamSam infiltrates by exploiting vulnerabilities or guessing weak passwords in a target's public-facing systems, and then uses mechanisms like the popular Mimikatz password discovery tool to start to gain control of a network. This way, the attack doesn't need to rely on trickery and social engineering to infect victims. And SamSam has been adapted to exploit a variety of vulnerabilities in remote desktop protocols, Java-based web servers, File Transfer Protocol servers, and other public network components.
Attackers deploying SamSam are also known to choose their targets carefully—often institutions like local governments, hospitals and health records firms, universities, and industrial control services that may prefer to pay the ransom than deal with the infections themselves and risk extended downtime. They set the ransoms—$50,000 in the case of Atlanta—at price points that are both potentially manageable for victim organizations and worthwhile for attackers.
And unlike some ransomware infections that take a passive, scattershot approach, SamSam assaults can involve active oversight. Attackers adapt to a victim's response and attempt to endure through remediation efforts. That has been the case in Atlanta, where attackers proactively took down their payment portal after local media publicly exposed the address, resulting in a flood of inquiries, with law enforcement like the FBI close behind.
"The most interesting thing about SamSam isn't the malware, it's the attackers," says Jake Williams, founder of the Georgia-based security firm Rendition Infosec. "Once they enter a network, they move laterally, spending time getting positioned before they start encrypting machines. Ideally organizations will detect them before they start the encryption, but that clearly wasn't the case" in Atlanta.
Hackers using SamSam have so far been careful about hiding their identities and covering their tracks. A February report by the threat intelligence firm Secureworks—which is now working with the City of Atlanta to remediate the attack—concluded that SamSam is deployed by either one specific group or a network of related attackers. But little else is known about the hackers in spite of how actively they've targeted institutions around the country. Some estimates say that SamSam has already collected almost $1 million since just December—thanks to a rash of attacks at the beginning of the year. The total largely depends on the fluctuating value of Bitcoin.