TG-iPASS portal fails ransomware attack test - The New Indian Express

The portal displayed a "Server is temporarily unavailable" message when accessed. Joint Director S Suresh reported that Cloud4C, which hosts the portal, was contacted immediately after the application failed to connect to the database, and the server was restarted, but the problem persisted.

Attack details

Further examination revealed that the SQL Server Agent service had stopped and could not be restarted. "Inspection later indicates that the server has been compromised and that the database and related files have been encrypted. The affected files bear an unfamiliar extension (.vgb), and a ransom note displaying a contact email address and a machine identifier ID was found on the server." { "type": "quote", "text": "The available indications suggest a ransomware attack.", "author": S Suresh, Joint Director in the Commissionerate of Industries }

Response measures

Officials have sought police assistance to contain and isolate the affected systems and preserve digital evidence. They've requested a forensic investigation to determine the attack vector, scope, and any unauthorized access or data exfiltration. The restoration of TG-iPASS services using validated clean backups or recovered data is also being pursued.

Response teams have been deputed to coordinate with the department, Cloud4C, and the TG-iPASS technical team. Based on the complaint, the TGCSB registered a case and launched an investigation.