More Chemical Company Attacks by NoReturn Group

The FBI announced today that Sohio Chemical of Columbus, OH reported a ransomware attack that was conducted by the NoReturn APT group. “We had been watching the progress of the previously identified attack as part of our ongoing investigation of the NoReturn group;” Johnathan Quest, a spokesman for the Federal Bureau of Inquiry; “The adversary then initiated a ransomware attack using a protocol we had not seen before, knocking out most of the corporate network”.

Sohio operates an acrylonitrile manufacturing facility in Wuhan, China. According to the company president, Franklin Veatch, because of the problems running a manufacturing facility in the epicenter of the COVID-19 outbreak in China and a recent push by the Trump Administration to move critical manufacturing back to the United States, Sohio was actively exploring moving their acrylonitrile manufacturing back to Ohio.

Dade Murphy, the CTO for Dragonfire Cyber, told reporters today that Dragonfire was working with Sohio because his company had detected the initial attack on the company while monitoring a server in China associated with the NoReturn group. “We had assured the company and the FBI that we could detect and block the ransomware attack,” Dade told reporters, “But the NoReturn group used a new attack methodology that we were not prepared to block. We will be ready the next time.”

Dade did note that the initial phishing email was disguised to appear to have come from a Sohio email account in their Wuhan, China manufacturing facility. “We have confirmed that it actually originated in the NoReturn group server in Guangzhou, China. The people who received the email in the headquarters engineering department would have had no way of knowing that.”

Veatch told reporters that; “Against the advice of both the FBI and Dragonfire, we decided to pay the 1,000-bitcoin ransom to get our system released.” The company had made every other day backups of most of their operational files, but while the attackers were operating within their systems, they had gained access to those backups and erased the last three backups just before the ransomware locked up the company systems. “We had critical financial files saved in those three missing backups, so we were forced to pay the ransom,” Franklin told reporters.

Murphy told reporters that Dragonfire was working with Sohio Chemical to determine if any critical engineering files were missing, something that they had seen in earlier attacks. “That does not seem to be the case in this attack, but we are seeing some indications that some of the engineering data may have been changed,” Murphy said.

Rep. Martin L. Davey (D,OH) is calling on the Cybersecurity Agency (CSA) and the Agency for Chemical and Environmental Security (ACES) to take a more active role in helping to prevent these types of attacks on critical infrastructure. Davey is planning on introducing new legislation requiring those agencies to protect critical chemical manufacturers for cyberattacks before next week’s House hearing on the NoReturn group.

CAUTIONARY NOTE: This is a future news story –

Second Truck GPS Attack Intercepted

Today the Federal Bureau of Inquiry announced that it had arrested three people in conjunction with a second attempted attack on a truck carrying hazardous chemicals. During the arrest there was a short shootout and one of the terrorists, a known member of Students for Immediate Neutralization of Chlorine Technology and Energy Reversion (SFINCTER), was injured. No chemicals were released during the incident.

Johnathan Quest, an FBI spokesman, said that after last week’s attack, all hazardous materials shipments by Avondale Trucking were being tracked by FBI and California Highway Police teams. When the GPS system on one of the trucks indicated that a GPS attack was taking place, Quest reported that sophisticated radio direction finding equipment was used to track down the source vehicle near the Avondale truck. The van was then stopped, and the terrorists arrested.

When asked why the Avondale Trucks had been targeted for FBI monitoring, Quest noted that the FBI had information that indicated that multiple attacks had been planned by SFINCTER on Avondale trucks because of the scheduling and routing information obtained from hacks of the company computer systems.

Francis L. Poncherello, a spokesman for the CHP, told reporters at a second news conference, that the third person arrested from the hacking vehicle was an Iranian national who was apparently providing GPS hacking technical support. Quest would not confirm that report, noting that the FBI was still working on identifying the third individual.

Willie C. Shealey from Avondale Trucking told reporters that the truck that was the target of the latest GPS hack was carrying acrylonitrile to a manufacturing location outside of San Jose, CA. He did not know what the apparent target of the attack was. Quest noted that that information was not yet available; technical experts from the FBI were still examining the GPS equipment found in the van.

Vera Arbeiten from the Chemical Safety Bureau told reporters that while acrylonitrile was not as toxic as chlorine gas, it could pose a serious health risk to personnel exposed to the chemical in an attack. She noted that medical treatment of the affected individuals would prove difficult in a mass casualty event because hospital emergency rooms would only have a limited number of the Cyanokits on hand to treat exposed personnel. Those kits are seldom used in normal ER operations, have a limited shelf-life and are relatively expensive.

Rep. Harvey Milk (D,CA) in a speech on the Senate floor today called for the resignation of the head of the Trucking Security Agency, noting that the TSA had taken no action on multiple congressional mandates to increase the security of hazardous material moved by truck across the country. Milk went on to say that: “The TSA approach of calling for voluntary compliance with vague security guidelines had resulted in the deaths of thirty-two elementary age students and a future of long-term disability for many more as a result of the Palo Alto attack. The fact that today’s attempted attack was only prevented by close FBI monitoring of all of the hazmat shipments of a single trucking company is just another indication of the need for strong security controls and close federal monitoring was needed.”

Milk is crafting legislation that would change the TSA mandate to include a detailed security program modeled on the one being used to monitor critical chemical manufacturing facilities.

CAUTIONARY NOTE: This is a future news story –