The printing and distribution of several U. S. newspapers including editions of the Wall Street Journal and New York Times have been disrupted by what appears to be a ransomware attack. The big question is who was behind this targeted and sophisticated attack?
The Wall Street Journal was one of many newspapers hit by a reported ransomware attack on the printing presses at Tribune Publishing yesterday. Getty
A server outage at Tribune Publishing on Saturday that prevented the distribution of many leading U. S. newspapers, including the Wall Street Journal, New York Times, Los Angeles Times, Chicago Tribune and Baltimore Sun was actually nothing of the sort. Instead, it appears to have been a cyber-attack involving what is thought to have been a version of the highly successful Ryuk ransomware family. Interestingly, Ryuk is often attributed to the Lazarus Group which is thought to operate out of China but in the hands of North Korean threat actors.
Tribune Publishing first detected the malware within corrupted files said to contain the Ryuk fingerprint of a ‘.ryk’ extension on Friday and initiated a fire-fighting response immediately. However, this proved not to be enough to prevent a major disruption to the production of the Saturday editions of not only the local newspapers that are printed at the LA Times’ Olympic printing plant in Los Angeles but also the west coast editions of national titles including the Wall Street Journal and New York Times.
