Ransomware Hits UK Website, Defaces Homepage

An anonymous reader writes: The website of the British Association for Counseling & Psychotherapy has been hit by a variant of the CTB-Locker ransomware. While the ransomware proclaims itself to be CTB-Locker, there are a ton of clues that reveal this may be a fake and this is actually the first ever ransomware family created to target websites and not computers.

Hmm

[liqu1d]

Bit of a random target. Wonder if they there's a reason this one was picked. Ie an out of date package or unfortunate coding.

Re:

[invictusvoyd]

Assuming most of the servers now a days are on some kind of virtualized platform, There should be a daily/weekly snapshot with which they could "restore" a new instance.

Re:

[Sax Russell 5449D29A]

Restore a new instance with the vulnerability fixed.

Not secure

[coastwalker]

The link to the hacked website returns

Secure Connection Failed

The connection to www.bacp.co.uk was interrupted while the page was loading.

        The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
        Please contact the website owners to inform them of this problem.

Re:

[softnewsit]

It worked last night. Probably the webmasters got wind of the fact he was pwned via the national press :)))

Re:Not computers.

[Barny]

All gets routed to a Fiji call center where the http requests are received and operators type back to your browser the CSS and HTML. Images are the hard bit, there is a guy with a webcam and a whole pile of photographs, as the requests come in he lines up the right photo and hits the capture button.

Re:

[jargonburn]

Either that, or they're really good with oven gloves...

https://xkcd.com/341/ [xkcd.com]

Version?

[namgge]

I guess this must be the 'CBT-Locker' variant.

Bummer

[nospam007]

After such an ordeal I guess they'll need counseling and psychotherapy.

wrong website

[rjejr]

They were probably targeting the BBC for pulling Dr Who off of Netflix and Hulu. "Give us back the Tardis or K-9 gets it!"

Obviously

[dhaen]

It's psychological warfare.

Not the server

[tijgertje]

Most likely that a pc from the organisation got infected and the website got updated from that pc or that the FTP-login got stolen. As a hoster we see "hacked" websites sometimes and it is always the pc of the customer. The server is nicely up to date.