Refinery Still Down from Ransomware Attack

Cesar Chavez of the Rafael Ravard Refinery in Baton Rouge, LA announced this morning that the refinery was still shut down from last month’s ransomware attack. “We initially decided not to pay the ransom since we had off sit backups for our major control system components, but after determining that the ransomware had encrypted device level software for which we had no backups, we decided that we had to pay the ransom” Chavez told reporters.

Chavez explained that the owners of the WannaControl malware added additional penalties for the delay in paying the ransomware and were now releasing the control system devices on a unit-by-unit basis with a separate, smaller ransom being required for each unit. So far, the refinery has reportedly paid out $1.9 million in bitcoin ransom payments.

Johnathan Quest, spokesman for the Federal Bureau of Inquiry, told reporters that the Bureau was still investigating the attack, but were unable to trace the ransom ware payments. “Bitcoin transactions are very difficult to trace, but we are working with a number of international law enforcement agencies and various intelligence agencies to crack the Bitcoin network.

Immanuel C. Securitage, spokesman for the ECS-CERT, told reporters that his agency was working closely with the refinery and Robotron on the security issues related to this attack. “The agency has not been notified of other facilities that may have experienced a WannaControl attack, but we suspect that some attacks have taken place and that the owners quickly paid the ransom to avoid the results that the refinery has experienced,” he explained.

ECS-CERT strongly recommends that anyone facility that had purchased Robotron pumps in the last half of 2019 immediately take them out of service until a Robotron representative can reload the motor control software. Facilities with such pumps in service should have their control system immediately checked for possible compromise. “ECS-CERT has noted that the refinery attackers apparently had access to the control system for at least a month before the attack was initiated,” Securitage reported.

In response to a reporter’s question about ECS-CERT support for finding apparently affected systems, Securitage said: “ECS-CERT does not have enough investigators to help everyone affected by the Robotron vulnerability, nor apparently does Robotron.” ECS-CERT is not allowed to recommend private sector companies that could do this work, but Securitage noted that: “Any major ICS security organization could probably do the assessment.”

Erich Mielke from Robotron released a statement that said the company was deploying as many of their security engineers as it had available to look at potentially affected Robotron control systems, but facilities that used Robotron pumps with other vendor control systems should probably reach out to the system vendor for assistance. Robotron has published a report on the malware that was loaded on their pump controllers that includes indicators of possible compromise that could be looked for on other products.

Rep. Harvey Milk (D,CA) announced that his subcommittee will be holding a hearing this week looking at the refinery attack. “We need to ensure that these types of ransomware attacks on critical infrastructure cannot happen,” he told reporters. He went on to criticize ECS-CERT’s inability to effectively support critical infrastructure owners in preventing further occurrences of this particular attack, saying: “Congress expects ECS-CERT to be proactive in responding to attacks like this; we want answers now.”

CAUTIONARY NOTE: This is a future news story –