Bhopal (Madhya Pradesh): Madhya Pradesh Computer Emergency Response Team (MPCERT) has issued a cybersecurity advisory to government departments following a recent LockBit ransomware attack on a government computer system.
The advisory outlines measures to protect Windows computers, servers and Active Directory environments from cyberattacks.
According to MPCERT, attackers exploit stolen credentials, system vulnerabilities and unsecured remote access to infiltrate networks.
They may steal sensitive data, escalate privileges, move across systems and encrypt files. Domain administrators are particularly vulnerable as their credentials can give attackers control over an entire organisational network.
The advisory identifies warning signs such as suspicious file extensions, ransom notes, deletion of backups, disabled security services, cleared event logs and unauthorised network activity.
Departments have been advised to use genuine, updated operating systems, maintain antivirus and endpoint detection systems, enforce strong passwords and enable multi-factor authentication.
MPCERT has also recommended restricting Remote Desktop Protocol access, limiting administrator privileges, disabling outdated authentication protocols and regularly auditing privileged accounts. It has emphasised maintaining three copies of backups.
In the event of an attack, affected systems should be isolated immediately without shutting them down to preserve memory and other forensic evidence.
What is LockBit?
LockBit is a sophisticated ransomware operating through a ransomware-as-a-service model. Its operators infiltrate networks, steal sensitive information, disable security systems and encrypt files to demand ransom.
