China's Industrial & Commercial Bank of China (ICBC)is in the process of restoring systems and services due to a attack ransomwarethat affected the US bond market, causing various problems.
As initially reported by the Financial Times, members of the Securities Industry and Financial Markets Association were informed of the incident on Thursday.
“ ICBC is currently unable to connect to DTCC/NSCC. This issue affects all ICBC clearing clients ,” a notice issued to equity investors said
“Due to this, it is temporarily suspending all incoming FIX connections and is not accepting orders at this time. We are in close contact with ICBC and will update you once the issue is resolved“.
See also: Kyocera AVX (KAVX): Ransomware attack led to data breach
The ransomware attack had a severe impact on the Chinese bank's systems, preventing it from settling US government bond trades on behalf of other market participants.
“We are aware of the cybersecurity issue and are in regular contact with key financial sector participants and federal regulators .We continue to monitor the situation,” a U.S. Treasury Department spokesperson told Bloomberg.
While the Industrial & Commercial Bank of China has yet to officially confirm the ransomware attack and its impact, multiple industry sources spoke to BleepingComputer about the incident.
Security expert Kevin Beaumont said an ICBC Citrix server that was last spotted online on Monday and was vulnerable to a NetScaler vulnerability security (Citrix Bleed) is now offline.
"It allows for complete, easy bypass of all forms of authentication and is used by ransomware groups. It gives attackers a fully interactive Remote Desktop PC," Beaumont explained about the vulnerability used to carry out the ransomware attack.
ICBC is China's largest bank and the world's largest commercial bank by revenue.
See also: SysAid: Vulnerability exploited in Clop ransomware attacks
It has 10.7 million corporate and 720 million individual customers. In addition to its 17,000 domestic branches, ICBC also has branches in 41 countries, including 13 branches on the east and west coasts of the United States.
Impact of ransomware attack on banks
One potential impact of a ransomware attack on a financial institution, such as Industrial & Commercial Bank of China (ICBC), is disruption of operations. The attack could cause payment systems to be disabled and customers’ financial data to be inaccessible.
Another potential impact is financial loss for the bank. The threat of data loss or disclosure may lead to ransom from attackers. In addition, the bank may suffer damage to its reputation and the trust of its customers.
See also: Ransomware manager: The “farnetwork” group is linked to five ransomware
A third potential impact is fines from authorities. Financial services must adhere to strict regulations to protect their customers. A attack can lead to a violation of these rules and result in financial penalties from authorities.
Finally, the ransomware attack could have a negative impact on ICBC's image and reputation. Data security attacks could be seen as a sign of the bank to protect its customers' information.
Source: www.bleepingcomputer.com
