Ransomware hackers are targeting managed service providers for local governments

Many ransomware attacks originate from a different nation than their target. One could arguably classify these attacks as a threat to national security, albeit primarily in an economic sense. When they hit medical targets though, it inches closer to basically profit-driven terrorism.

With that said, I'd love to see the full power of western signals intelligence loosed on these attackers. If they're going to spend our tax dollars on domestic surveillance, may as well get some use out of those programs.

I've often thought using these capabilities for early detection of active shooters might not be the worst idea either, granted it's far more of a legal and ethical gray area there, at least in the US.

Foreign ransomware attackers who target medical systems however, should pretty much receive the same classification and treatment as normal terrorists. If they're beyond any reasonable legal jurisdiction, then extrajudicial means should be used to eliminate them as a threat. I'm not saying torture and assassination, but messaging. Most for-profit criminals, after they realize they've been targeted and identified by an intelligence agency, will probably change their ways pretty quickly, or even end up being turned into assets.

I've seen attacker breach a gov-app. I had a unique email on that system that was then mailed an offer to buy the database and application code (for like 18USD in BTC at the time) The sample attached to the message had a CSV with like 2200 emails, users and gov addresses. Amazing, the vendor is still there and the agency kinda brushed it under the rug.

E: found an article here

https://www.thenewstribune.com/news/local/article199383069.h...

I wonder if most of the targets are still running Windows 7 and older? I know Win 10 isn’t totally immune, but if you enable all the security options it’s harder to penetrate. Am I wrong?