Cybersecurity expert on ‘Robbinhood’ ransomware attack: Recovery could take months

The ransomware being used in an attack on the City of Baltimore’s IT systems was identified as “Robbinhood.”

At a news conference on Wednesday, Chief Information Officer Frank Johnson said the attack was discovered early Tuesday, shutting down the “majority” of the city’s servers, though emergency services remained available.

The FBI is investigating, and “has confirmed that it’s a fairly new variant that is quite aggressive,” Johnson said. “Technicians right now are trying to remediate the root cause,” as well as what’s been impacted and affected.

With systems down, city employees are reverting to manual processes. Mayor Bernard C. “Jack” Young said all employees still reported to work, however, and expressed confidence in the city’s team to resolve the issue.

“If we are in this for longer than we anticipate, I’ll be asking city employees who really can’t do their work because of the computer systems, would they be willing to go out and help us clean up the city,” Young said. (It’s not clear if he meant “clean” literally.)

Ransomware is a type of malware in which attackers use encryption to prevent access to a system. The attackers often demand a payment to reopen access.

Separate from the officials’ comments, Technical.ly reached out to Todd Weller, chief strategy officer with Columbia cybersecurity firm Bandura Cyber, to learn more about how this type of attack can affect cities.

As for RobbinHood in general, Weller said it’s a “relatively new strain of ransomware, which first appeared in mid-April. There is still a lot of work being done to understand the details of how this threat works.” For example, it’s still unclear how the ransomware enters a network and infects computers.

As demonstrated by the employees reverting to manual processes, the impact of an attack can be widespread.

“What we have seen from incidents like the city of Atlanta and Baltimore is that critical and non-critical systems are taken down, which negatively impacts normal operations. These negative impacts could often result in the unavailability of services or degradation of service delivery quality,” he said.

Even as the emergency services remain operational, the quality of service can be affected. And as seen with agencies such as the departments of public works, housing and recreation, the impacts can extend to other business operations.

The timeframe for recovery from such an attack is weeks to months, Weller said.

“The city of Atlanta was still being impacted several months after the ransomware attack, with the finalization of its annual budget impacted,” he said.