The Tribunal de Justiça do Estado do Rio Grande do Sul (TJRS), the judicial system of the Brazilian state of Rio Grande do Sul, has fallen victim to the ransomware gang. The hackers managed to encrypt employees' files and forced the courts to shut down their network.
The attack began the day before yesterday morning. Employees went to work to find that all their documents and images were no longer accessible. Instead, their computers displayed a note from the hackers, informing them of the attack and demanding a ransom.
See also: REvil: Now threatening to leak designs for new Apple logos and iPads!
Shortly after the attack began, the official TJRS Twitter account warned employees not to connect to TJ network systems, either locally or via remote access.
“ TJRS informs that it is experiencing problems in computer systems. The systems security team advises internal users not to access computers remotely, nor to connect to computers within the TJ network ,” the Rio Grande do Sul court said on Twitter
ransomware gang behind attack on Rio Grande do Sul's judicial system
A Brazilian security researcher known as Brute Bee showed BleepingComputer a screenshot of the ransom notes that hackers left on employees' systems.
These notes appear to be related to the Revil ransomware gang.
It is said that the hackers demanded $5,000,000 for the decryption of files, but also not to leak data they stole from the systems.
See also: Acer: REvil ransomware gang demands $50,000,000 ransom!
BleepingComputer also obtained an audio recording, where one person describes the attack as “horrific” and “the worst thing that ever happened there.” TJRS IT staff is in a state of panic as they try to restore thousands of devices.
This is not the first time that Brazil's judicial system has been targeted by cybercriminals.
Last November, the Brazilian Supreme Court was attacked by the RansomEXX ransomware gang, which began encrypting devices in the middle of court videoconferences.
See also: Brazilian Supreme Court: Fell victim of RansomExx ransomware
At the same time, sites of other Brazilian federal government agencies were offline, but it was not clear whether they were down due to an attack or if they were taken down for protection.
Source: Bleeping Computer
