CBC News: eSentire’s Mark Sangster on the Conti Ransomware Gang and Recent Healthcare Cyber Attacks

Mark Sangster, Vice President, Industry Security Strategies at eSentire, appeared on CBC News to speak about the top-tier Conti ransomware gang and their alleged targeting of Canadian critical infrastructure with the recent attack on the Newfoundland and Labrador health network.

During the CBC News interview, Mark addresses:

• Why it’s likely that the Conti ransomware gang is behind the cyber attack based on research conducted by eSentire’s Threat Response Unit (TRU),

• How ransomware gangs resemble sophisticated Fortune 500 companies in the way they manage their operations and generate revenue,

• The tactics, techniques, and procedures (TTPs) utilized by the ransomware gangs to deploy their cyber attacks,

• Why Conti targets critical infrastructure organizations, and more.

Watch the full interview below to learn more.

According to the Cybersecurity & Infrastructure Security Agency (CISA), there are “16 critical infrastructure sectors whose assets, systems, and networks are considered so vital that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof”. Cyber attacks against critical infrastructure, including healthcare institutions, have become high-value targets for ransomware gangs looking to cause systemic disruption and societal chaos.

Conti, also known as Ryuk, has increased its focus on targeting Canadian companies following the shutdown of the REvil/Sodinokibi ransomware gang at the hands of the U.S. law enforcement agencies. The Conti group uses the “double extortion” ransomware tactic against its victims. They not only encrypt the victim’s data but also threaten to sell it to other threat actors if they don’t get paid the ransom demand. Recently Conti’s affiliate program appears to have pivoted from publishing and selling its victim’s stolen files to selling access to many of the organizations it has hacked.

Currently, over 50% of eSentire customers operate within the critical infrastructure segments recognized by CISA. To learn more about how we protect the critical data and applications of these firms with 24/7 multi-signal Managed Detection and Response and Incident Response services, book a meeting with a security specialist today.