FBI Puts Ag on Alert: Ransomware Attack Potentially Timed to Critical Seasons

Farmers and ag cooperative need to be on high alert this spring. That’s according to the FBI, which is predicting cyber criminals might attack the industry during planting and harvest.

Farmers and ag cooperative employees need to be on high alert this spring. That’s according to the FBI, which is predicting cyber criminals might attack the industry during planting and harvesting seasons.

Why? Cyber criminals believe their prey could be more vulnerable and willing to pay off the extortion.

Since 2021, FBI reports multiple agricultural cooperatives have been impacted by a variety of ransomware variants:

In March 2022, a multi-state grain company suffered a Lockbit 2.0 ransomware attack. In addition to grain processing, the company provides seed, fertilizer, and logistics services, which are critical during the spring planting season.
In February 2022, a company providing feed milling and other agricultural services reported two instances in which an unauthorized actor gained access to some of its systems and may have attempted to initiate a ransomware attack. The attempts were detected and stopped before encryption occurred.
Between Sept. 15 and Oct. 6, 2021, six grain cooperatives experienced ransomware attacks. A variety of ransomware variants were used, including Conti, BlackMatter, Suncrypt, Sodinokibi, and BlackByte. Some targeted entities had to completely halt production while others lost administrative functions.
In July 2021, a business management software company found malicious activity on its network, which was later identified as HelloKitty/Five Hands ransomware. The threat actor demanded a $30 million ransom. The ransomware attack on the company led to secondary ransomware infections on a number of its clients, which included several agricultural cooperatives.

These attacks resulted in service issues, production disruptions and loss of access to administrative functions.

In a public advisory, federal officials say a major disruption of grain production would impact the entire food chain.

What You Can Do

The FBI is asking those in agriculture to take defensive measures against the potential threat. Those steps include:

Regularly back up data, air gap and passwords. Make backup copies offline. Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.
Implement a recovery plan that includes maintaining and retaining multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., hard drive, storage device, the cloud).
Identify critical functions and develop an operations plan if systems go offline. Think about ways to operate manually if it becomes necessary.
Implement network segmentation.
Install updates/patch operating systems, software and firmware as soon as they are released.
Use multifactor authentication where possible.
Use strong passwords and regularly change passwords to network systems and accounts, implementing the shortest acceptable timeframe for password changes. Avoid reusing passwords for multiple accounts and use strong pass phrases where possible.
Require administrator credentials to install software.
Audit user accounts with administrative or elevated privileges and configure access controls with least privilege in mind.
Install and regularly update anti-virus and anti-malware software on all hosts.
Only use secure networks and avoid using public Wi-Fi networks. Consider installing and using a virtual private network (VPN).
Consider adding an email banner to messages coming from outside your organizations.
Disable hyperlinks in received emails.
Focus on cyber security awareness and training. Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities (i.e. ransomware and phishing scams).

Tools and Resources

Tips for Protecting Yourself Against Ransomware Attacks

For additional resources related to the prevention and mitigation of ransomware, visit Stopransomware.gov

CISA’s Ransomware Readiness Assessment (RRA) is a no-cost self-assessment based on a tiered set of practices to help organizations better assess how well they are equipped to defend and recover from a ransomware incident.

CISA offers a range of no-cost cyber hygiene services to help critical infrastructure organizations assess, identify, and reduce their exposure to threats, including ransomware. By requesting these services, organizations of any size could find ways to reduce their risk and mitigate attack vectors.

Watch our report on AgDay TV: