ARN

Cadbury factory in Hobart hit as ransomware attacks Aussie businesses

Petra malware used exploit patched two months ago

At least two Australian companies have been hit following a global ransomware outbreak, with the Cadbury factory in Hobart one of the local businesses impacted.

The global attack - which originated in Ukraine on 27 June and quickly spread to Russia, parts of Europe the US and India - has now reached Australian shores, impacting both Cadbury and DLA Piper, a global law firm with local offices.

Mondelez International, the parent company of the chocolate manufacturer, has confirmed the attack, advising that systems have been down since last night.

Australian Manufacturing Workers Union Tasmanian president, John Short, told ARN that Cadbury's Claremont facility was hit at approximately 9:30pm on 27 June, with all production at the facility halted since.

“In talking to people, it appears all the computers had gone down and the employees are now set to cleaning duties,” he said.

Short added that no employees had been sent home as a result of the attack.

In addition, Australian staff from global law firm DLA Piper have been told the local offices were the victim of a “major cyber incident”, according to the ABC.

The ABC reported that Australian staff were advised via text early on 28 June that all DLA Piper IT systems have been taken down to contain the situation and have been warned not to attempt to log in to their computers or turn them on.

A text message sent to DLA Piper Australia staff this morning (Source: ABC)
A text message sent to DLA Piper Australia staff this morning (Source: ABC)

The Federal Government’s Stay Smart Online service has warned that businesses, individuals and households who have not updated Microsoft Windows software are potentially vulnerable to the virus.

The Minister assisting the Prime Minister for cyber security, Dan Tehan, has also urged small businesses to take urgent action to improve cyber security practices in the wake of a second global ransomware attack in as many months.

"We are aware of the situation and monitoring it closely, we are in contact with our Five Eyes partners,” Tehan said. “It appears to be the same vulnerability as Wannacry.

“All businesses should immediately update their Windows operating system with the latest security patches and there are instructions on the ACSC website to do this. This ransomware attack is a wake-up call to all Australian businesses to regularly backup their data and install the latest security patches."

The government said it will continue to provide updates on this issue.

Specifically, the Petya or GoldenEye ransomware strain exploits a vulnerability in Microsoft Windows which was exposed in the recent Wannacry outbreak.

The company patched the vulnerability in March but due, at least in part, to ineffective patch policies, many companies, including the victims of the recent attack were hit.

At this stage, several global companies have confirmed to have fallen victim to the ransomware attack, including Chernobyl’s radiation monitoring system; DLA Piper; pharmaceutical company Merck; a number of banks in Europe and the US; an airport; the Kiev metro; Danish shipping and energy company Maersk; British advertiser WPP and Russian oil industry company, Rosnoft.

At a global level, the ransomware was widespread in Ukraine - where the attack appears to have originated affecting Ukrenergo, the state power distributor, and several of the country’s banks.

Cyber security company, Bitdefender, confirmed in a blog post that the GoldenEye / Petya ransomware leverages the EternalBlue exploit to spread from one computer to another. It added that additional exploits are also used to propagate.

The EternalBlue exploit is one of the tools used in the recent Wannacry outbreak and is believed to have been originally developed by the NSA.