Operations at the Office of the Colorado State Public Defender have been limited following a cyberattack that had been ongoing on the morning of Feb. 9, which has prompted the takedown of its computer network, reports The Denver Post.
Such a disruption, which has prevented access to work computers, court dockets, and court filings, is expected to be resolved in a week, according to office spokesperson James Karbach, who noted that some of the system's data were malware-encrypted but emphasized that the intrusion did not affect the state's court system.
Despite scant details regarding the incident, Colorado's state public defender's office is believed by Metropolitan State University of Denver Computer Sciences Department Chair Steve Beaty to have been affected by a ransomware attack.
Meanwhile, National Cybersecurity Center Chief Strategy Officer Mark Weatherford noted the mounting incidence of ransomware attacks against government agencies.
"The privacy and sensitive information of all their clients is what I would be most concerned about right now," Weatherford said.
An In-Depth Guide to Ransomware
Get essential knowledge and practical strategies to protect your organization from ransomware attacks.
Aside from primarily leveraging basic usernames for their accounts, organizations impacted by ransomware intrusions from July to September — including those in the government and healthcare industries — also mostly failed to implement multi-factor authentication that could have deterred brute-force attacks.
Included in the Phobos-hit organizations that paid a ransom were a California public school system, a North Carolina children's hospital, a Maryland-based accounting and consulting service provider, and health organizations in Pennsylvania and Maryland, revealed an unsealed indictment against suspected Phobos administrator Evgenii Ptitsyn.
Alleged Scattered Spider hackers Ahmed Hossam Eldin Elbadawy, Noah Michael Urban, Evans Onyeaka Osiebo, Joel Martin Evans, and Tyler Robert Buchanan have been indicted for their involvement in a prolonged cryptocurrency theft operation that involved SMS phishing, corporate system compromise, and further phishing intrusions.