Bloomberg:

Transcripts reveal University of California at San Francisco’s weeklong negotiation to free its ransomware-locked servers. The haggling worked, sort of

Great article but missing a key ingredient – how did they get in in the first place? Answer — Pfishing. And why didn’t their anti-malware prevent this? Probably did not implement it correctly and/or their anti-malware provider did not provide quality sandboxing.

Still a great read. Link to Bloomberg Article Here

According to the hackers’ dark web blog, the ransomware used to attack UCSF came from Netwalker, a hacking operation that has boomed since last fall. Netwalker malware can be leased by would-be attackers as a kind of franchise program. In March, the group posted a dark web want ad to recruit new affiliates. The qualifications included: “Russian-speaking network intruders—not spammers—with a preference for immediate, consistent work.” In June, a further ad prohibited English speakers from applying, according to Cynet, a digital security company in Tel Aviv.

Tripwire’s Graham Cluley published a FAQ last May on Netwalker if you wish to read more. Here is the link

For a more in-depth look at Netwalker, Sophos has a great article here https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/