The Guardian-Ransomware attack on Chinas biggest bank disrupts US Treasury market
November 10, 2023 3 min 567 words
这次中国工商银行美国分支遭到勒索软件攻击，导致美国国债市场受到干扰，着实令人担忧。攻击不仅对银行内部系统造成了破坏，还引发了对市场参与者网络安全控制和监管的关切。勒索软件团伙Lockbit被认为是幕后黑手，这种攻击规模罕见，凸显了勒索软件团伙日益嚣张的趋势。美国当局一直在努力遏制网络犯罪，特别是勒索软件攻击，但成效有限。这次事件不仅暴露了大型机构系统的脆弱性，也引发了对市场参与者网络安全控制和监管的担忧。工商银行虽然表示成功清理了周三执行的国债交易和周四的回购协议融资交易，但有市场参与者表示，由于攻击，通过工商银行的交易未能结算，影响了市场流动性。这次事件凸显了金融体系对网络安全的脆弱性，市场监管方面可能会进一步加强。
The Industrial and Commercial Bank of China’s US arm was hit by a ransomware attack that disrupted trades in the US Treasury market on Thursday, the latest in a string of victims ransom-demanding hackers have claimed this year.
ICBC Financial Services, the US unit of China’s largest commercial lender by assets, said it was investigating the attack that disrupted some of its systems, and making progress toward recovering from it.
China’s foreign ministry said on Friday the lender was striving to minimise risk impact and losses after the attack.
“ICBC has been closely monitoring the matter and has done its best in emergency response and supervisory communication,” the ministry spokesperson Wang Wenbin said.
Wang added that businesses remained normal at ICBC head office and other branches and subsidiaries across the globe.
Hackers lock up a victim organisation’s systems in such attacks and demand ransom for unlocking it, often also stealing sensitive data for extortion.
Several ransomware experts and analysts said an aggressive cybercrime gang named Lockbit was believed to be behind the hack, although the gang’s dark website where it typically posts names of its victims did not mention ICBC as a victim as of Thursday evening. Lockbit did not respond to a request for comment sent via a contact address posted on its site.
“We don’t often see a bank this large get hit with this disruptive of a ransomware attack,” said Allan Liska, a ransomware expert at the cybersecurity company Recorded Future.
Liska, who also believes Lockbit was behind the hack, said ransomware gangs may not name and shame their victims when they are negotiating with them.
“This attack continues a trend of increasing brazenness by ransomware groups,” he said. “With no fear of repercussions, ransomware groups feel no target is off limits.”
US authorities have struggled to curb a rash of cybercrime, chiefly ransomware attacks, which hit hundreds of companies in almost every industry each year. Only last week US officials said they were working on curtailing the funding routes of ransomware gangs by improving information-sharing on such criminals across a 40-country alliance.
The ICBC did not comment on whether Lockbit was behind the hack. It is common for targets to refrain from publicly disclosing the names of cybercrime gangs.
Since Lockbit was discovered in 2020, the group has hit 1,700 US organisations, according to the US Cybersecurity and Infrastructure Security Agency. Last month it threatened Boeing with a leak of sensitive data.
A Cisa spokesperson referred questions about the ICBC hack to the US Treasury department.
While market sources said the impact of the hack appeared to be limited, it signalled how vulnerable systems at large organisations such as the bank continue to be. Thursday’s incident is likely to raise questions over market participants’ cybersecurity controls and draw regulatory scrutiny.
ICBC said it had successfully cleared Treasury trades executed on Wednesday and repurchase agreements (repo) financing trades done on Thursday.
“In general, the event had a limited impact on the market,” said Scott Skyrm, the executive vice-president for fixed income and repo at the broker-dealer Curvature Securities.
Some market participants said trades going through ICBC were not settled because of the attack and affected market liquidity. It was not clear whether this contributed to the weak outcome of a 30-year bond auction on Thursday.