Ecuador declares 'institutional emergency' at state telco

Ecuador has declared a state of “institutional emergency” at state-run telco CNT in the wake of a cyberattack.

The attack last week, which is being attributed to the RansomEXX ransomware, disrupted the company's services and contact centers and paralyzed customer services such as online payment and prepaid top-ups, among others.

CNT promised clients would not have services suspended due to non-payment.

The company also gave a bonus of 1GB of mobile broadband to clients who had topped up in recent months.

The telco filed a complaint within the attorney general’s office to carry out the investigation and find those responsible. 

Juan Carlos Soria, CNT's national legal manager, told local media that there has been no leakage of customer information. He labeled the attack "highly sophisticated."

Recently, CNT said billing services have resumed nationwide.

OTHER MEASURES

In addition to the state of institutional emergency, government spokesperson Alexandra Vela and telecommunications minister Vianna Maino announced the government will appoint an official to oversee the situation at CNT.

They added CNT will also get a cybersecurity team and the government plans to create a cybersecurity department.

The officials promised an external audit with “high-level international companies” to review CNT’s procurement processes, systems purchases and technological infrastructure, adding that the government plans to update and modernize the telco’s technology park.

Finally, authorities started engagements with the OAS cybersecurity office, in addition to promoting a cybersecurity reform in the national assembly.

“Improving the company (CNT) is a great challenge, but also a great opportunity to achieve a true integral development of the corporation and the state,” Maino said according to a press release. 

“We will make CNT a benchmark in the regional market.”

RANSOMEXX

According to Russian security firm Kaspersky, RansomEXX is a highly targeted and effective trojan. It started targeting multiple companies in mid-2020. 

RansomEXX is reported as being used in attacks on institutions such as Brazilian gas transport company Ultrapar Participações and aircraft maker Embraer, the Texas Department of Transportation, Japanese manufacturer of printing equipment Konica Minolta, and Pertamina EP, an Indonesian public oil firm, among others.

In a January report, Japan's Trend Micro said RansomEXX had been showing signs of “further development and unhampered activity,” involving the use of newer variants adapted for Linux servers that expanded its reach from Windows servers.

According to a study by UK security firm Sophos in January and February, 37% of participating organizations said they were hit by ransomware in the 12 months prior to the survey.

The figure is however down from 51% from the 2020 survey.

The study was commissioned to research firm Vanson Bourne, which interviewed 5,400 IT decisionmakers in 30 countries, including Brazil, Chile, Colombia and Mexico. Most companies were from the IT and telecom sector.

Fewer organizations suffered data encryption as the result of an attack – down from 73% in 2020 to 54% in 2021, according to the study.

"However, while the number of organizations being hit by ransomware has dropped since last year, the financial impact of an attack has more than doubled, increasing from US$761,106 in 2020 to US$1.85mn in 2021," Sophos wrote.

According to the security firm, this is likely due, in part, to more advanced and complex targeted attacks that are harder to recover from.

It is not clear whether Ecuador's CNT paid a ransom for the release of its systems.