Telkom / BCX affected by Ponyfinal ransomware

[Anthro]

Colleague's dad works at Telkom... apparently they are down (completely?) as a result of this

Microsoft warns about attacks with the PonyFinal ransomware

PonyFinal infections have been reported in India, Iran, and the US.

www.zdnet.com

"PonyFinal is a Java-based ransomware that is deployed in human-operated ransomware attacks," Microsoft said in a series of tweets published today.

Human-operated ransomware is a subsection of the ransomware category. In human-operated ransomware attacks, hackers breach corporate networks and deploy the ransomware themselves.

This is in opposition to classic ransomware attacks that have been seen in the past, such as ransomware distributed via email spam or exploit kits, where the infection process relies on tricking the users in launching the payload.

 

[irBosOtter]

Jip, also heard that BCX/Telkom is down due to ransomware (from a guy working there)

 

[|tera|]

I'm still online and purring away on Telkom. So if true, it's probably specific servers/systems that are effected.

 

[r00igev@@r]

All those millions and millions spent on Cisco firewalls obviously does not help?

 

[Pythonista]

Just Use Linux

 

[wernervn]

All those millions and millions spend on Cisco firewalls obviously does not help?

Makes you wanna cry...

 

[r00igev@@r]

Just Use Linux

#truestory

 

[j4ck455]

Sounds grammatically challenged, surely FinalPony or just Pony, or even ShartlandPony would have been better names.

Presumably it refers to the final build of ransomware called "Pony".

 

[Barbarian Conan]

Java and Flash, the two pieces of malware that my PC will never see again.

 

[Anthro]

Telkom call centres back online following malware attack

Telkom call centres back online following malware attack Telkom call centres are back online after the company shut down several systems in response to an infection of malicious software, a spokesperson has told MyBroadband. "On Friday, 29 May, Telkom became aware of a malware infection on its...

mybroadband.co.za

 

[MDKza]

All those millions and millions spent on Cisco firewalls obviously does not help?

Forti's as well

 

[MDKza]

Just Use Linux

I mean most firewalls use some or other flavour of linux..

 

[r00igev@@r]

Forti's as well

Hope they publish a case study on how badly they screwed up.

 

[irBosOtter]

All those millions and millions spent on Cisco firewalls obviously does not help?

Well, you also need someone to setup the firewall correctly for it to block the download of the file, or to block the url's, most of these url's are valid though
But i'm sure in Telkom's case they probably just allow exe file downloads, most companies do it seems.
Main problem I have seen is people take laptops home and are not protected via company firewall, then the file downloads and installs on the laptop. Next day, plugs into office network, and well there you go. I have only seen cases like that, people bring it into the office from home mostly

 

[r00igev@@r]

Well, you also need someone to setup the firewall correctly for it to block the download of the file, or to block the url's, most of these url's are valid though
But i'm sure in Telkom's case they probably just allow exe file downloads, most companies do it seems.
Main problem I have seen is people take laptops home and are not protected via company firewall, then the file downloads and installs on the laptop. Next day, plugs into office network, and well there you go. I have only seen cases like that, people bring it into the office from home mostly

Its irrational to boxdrop a firewall without the relevant associated processes and skills. Still the vendors fault. Someone paid them and they must deliver a solution.
In most of these cases, the problem could have been mitigated by using Quad 9.

 

[MDKza]

Hope they publish a case study on how badly they screwed up.

Most of the time its a configuration issue rather than a firewall problem, this is why people get paid to do what they do.

 

[r00igev@@r]

Most of the time its a configuration issue rather than a firewall problem, this is why people get paid to do what they do.

Or in this case paid and not do what they should be doing!!!