Ransomware Attack on Norton Public Schools by LockBit: Impact and Details
Incident Date:
July 19, 2024
Overview
Title
Ransomware Attack on Norton Public Schools by LockBit: Impact and Details
Victim
Norton Public Schools
Attacker
Lockbit3
Location
First Reported
July 19, 2024
Ransomware Attack on Norton Public Schools by LockBit
Overview of Norton Public Schools
Norton Public Schools, located in Norton, Massachusetts, is a public school district serving students from preschool through 12th grade. The district is dedicated to providing a rigorous and comprehensive educational experience aimed at nurturing the intellect of every student. With a mission to promote individual talents and maximize each student's potential, Norton Public Schools fosters a partnership with families and the community to prepare students for responsible global citizenship. The district employs between 201 and 500 individuals, indicating a medium-sized educational institution.
Details of the Ransomware Attack
On July 19, 2024, Norton Public Schools fell victim to a ransomware attack orchestrated by the notorious cybercriminal group LockBit. The attack targeted the district's official domain, norton.k12.ma.us. While the exact size of the data leak remains unknown, the incident underscores the growing threat of ransomware attacks on educational institutions. The attack has disrupted the district's operations, potentially compromising sensitive student and staff information.
About LockBit
LockBit, also known as LockBit Black, is a highly sophisticated ransomware-as-a-service (RaaS) group that has been active since September 2019. It has become the most active ransomware group, responsible for over one-third of all ransomware attacks in the latter half of 2022 and the first quarter of 2023. LockBit employs "double extortion" tactics, exfiltrating sensitive data and threatening to release it publicly if the ransom is not paid. The ransomware uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files.
Penetration and Vulnerabilities
LockBit is designed to exploit vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network. It performs a check to avoid executing on computer systems with installed languages common to the Commonwealth of Independent States (CIS) region. The ransomware group distinguishes itself by its modular design, which encrypts its payload until execution to hinder malware analysis and detection. Indicators of Compromise (IOCs) for LockBit include the creation of a mutual exclusion object (Mutex) when executed, the use of a unique icon, and changes to the victim's computer wallpaper.
Impact on Norton Public Schools
The ransomware attack on Norton Public Schools highlights the vulnerabilities educational institutions face in the digital age. The district's commitment to technology and innovation, while beneficial for educational purposes, also makes it a target for cybercriminals. The attack has likely disrupted the district's operations, affecting both academic and support services. The incident serves as a stark reminder of the importance of robust cybersecurity measures in protecting sensitive information and ensuring the continuity of educational services.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.