Latest / Tech Talks With Kinsoft / Foster City, California – Ransomware Halts a City

Transcript

Foster City, California – Ransomware Halts a City · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Glad to be
• 0:02
  here. Today, we are taking a stack of really
• 0:06
  compelling reporting and extracting the most
• 0:09
  important, actionable nuggets of knowledge for
• 0:12
  you, the listener. Right. Our premise for this
• 0:14
  show is pretty simple. We break down the sources,
• 0:16
  synthesize the noise, and help you understand
• 0:20
  the structural mechanisms behind the headlines.
• 0:22
  Exactly. And to start off this exploration, I
• 0:25
  want you to imagine something for a second. Okay.
• 0:27
  Imagine waking up tomorrow morning and discovering
• 0:29
  that your local city government has effectively
• 0:32
  been thrown into a time machine. Just completely
• 0:34
  rolled back. Yeah, exactly. The dial is set straight
• 0:37
  back to the 1980s. There is no email. There are
• 0:41
  no online payment portals. Wow. The city council
• 0:44
  meetings, which you usually stream from the comfort
• 0:46
  of your couch, are suddenly operating entirely
• 0:48
  offline. They are relying on physical paper and
• 0:51
  in -person attendance. I mean, it sounds like
• 0:54
  an administrative nightmare, but it is increasingly
• 0:58
  the reality for local governments navigating
• 1:00
  modern network architecture. It is absolutely
• 1:03
  not fiction. Our mission today is to analyze
• 1:07
  the March 2026 ransomware attack that completely
• 1:11
  paralyzed Foster City, California. Yeah, a really
• 1:14
  significant case. We are pulling from on the
• 1:17
  ground reports from the record in GovTech to
• 1:19
  map out exactly what happened. We are going to
• 1:22
  look at why small budget constrained municipalities
• 1:24
  are increasingly finding themselves in the crosshairs
• 1:28
  of highly organized cyber criminals. Right. And
• 1:31
  we'll explore what. digital resilience actually
• 1:33
  requires in practice. It is a really critical
• 1:35
  analysis. We often analyze cyber warfare through
• 1:38
  the lens of massive corporate conglomerates,
• 1:41
  right, or federal agencies. But the reality on
• 1:43
  the ground has shifted rapidly to these softer
• 1:46
  localized targets. Yeah, that's a great point.
• 1:48
  And to set the stage for you, the listener, think
• 1:51
  about a city's IT infrastructure as a digital
• 1:53
  nervous system. It connects everything from public
• 1:56
  works to police dispatch and utility billing.
• 1:58
  Everything relies on it. Exactly. So when a malicious
• 2:01
  actor strikes, the entire body basically has
• 2:03
  to freeze to protect the vital organs. That's
• 2:06
  a really good analogy. So let's unpack the timeline
• 2:08
  of this freeze. It was Thursday, March 19, 2026.
• 2:13
  IT staff in Foster City, which is a Bay Area
• 2:16
  municipality of about 34 ,000 people, identified
• 2:19
  what they initially flagged as suspicious activity.
• 2:22
  Right. The classic red flag. Yeah. And they quickly
• 2:25
  confirmed they had an active ransomware infection
• 2:27
  on their networks. And the immediate fallout
• 2:30
  was. I mean it was severe. The city effectively
• 2:32
  suspended most non -emergency services instantly.
• 2:36
  Just pulled the plug. Completely. Phone systems
• 2:38
  went offline. Email went down. Online access
• 2:41
  to city services was completely disrupted. It
• 2:43
  was a total communication blackout for standard
• 2:45
  civic machinery. Wow. And as you mentioned with
• 2:49
  that retro pivot earlier, city council meetings
• 2:51
  could no longer be held on Zoom. They had to
• 2:53
  transition strictly to in -person sessions. OK,
• 2:55
  let's unpack this, because pulling the plug on
• 2:57
  your own network sounds like a, well, a chaotic
• 3:00
  reaction. It does. We always hear about taking
• 3:02
  systems offline to stop the spread, but I want
• 3:05
  to push back on that. logic a bit. Doesn't hard
• 3:08
  shutting down a network mid -attack run the risk
• 3:11
  of corrupting the very databases you are trying
• 3:13
  to save? Like if a critical database is in the
• 3:16
  middle of a write operation. Oh, absolutely.
• 3:18
  That is a highly debated point in incident response.
• 3:21
  Yeah. And you are right to highlight the risk.
• 3:24
  Hard killing a server can absolutely cause data
• 3:26
  corruption. Right. But what's fascinating here
• 3:29
  is the technical calculus behind that triage
• 3:31
  choice. When ransomware executes, it needs to
• 3:35
  communicate with the attacker's command and control.
• 3:37
  or C2 server. The malware has to phone home to
• 3:40
  exchange the public encryption keys before it
• 3:43
  can start locking up your files. So by taking
• 3:46
  the network offline, you aren't just hitting
• 3:48
  a panic button, you are actively severing that
• 3:50
  C2 connection. If the payload can't complete
• 3:52
  that key exchange, the encryption process halts.
• 3:55
  So you accept the risk of localized data corruption
• 3:58
  to prevent a network -wide cryptographic lockdown.
• 4:01
  Exactly. It's a tradeoff. So it is a calculated
• 4:03
  amputation to stop the infection from moving
• 4:06
  laterally. And we saw that triage applied specifically
• 4:09
  in Foster City. While routine services flatlined,
• 4:13
  they ensured that 9 -11 and police dispatch deliberately
• 4:16
  stayed functional. Which is critical, obviously.
• 4:19
  Right. The police direct lines did experience
• 4:21
  a brief outage, but they were restored by Friday
• 4:23
  night. And then we saw city manager Stefan Chatwin
• 4:26
  declare a local state of emergency. Now, my instinct
• 4:30
  is to read that as a legal maneuver rather than
• 4:33
  a purely operational one. You're spot on. It
• 4:35
  is entirely a strategic administrative step.
• 4:38
  Declaring a state of emergency specifically unlocks
• 4:42
  mutual aid. It opens up supplementary financial
• 4:44
  support and rapid procurement protocols that
• 4:47
  bypass standard municipal red tape. Because they
• 4:50
  just don't have the time to wait. Right. I mean,
• 4:52
  a town of 34 ,000 people does not have an idle
• 4:54
  bench of digital forensics experts waiting around.
• 4:57
  They needed outside incident response firms immediately.
• 5:00
  And that declaration was the legal mechanism
• 5:02
  to authorize those resources. Exactly. Without
• 5:05
  waiting for a month of city council budget approvals.
• 5:08
  But taking the system offline is just a tourniquet,
• 5:10
  right? It doesn't tell us how the attackers got
• 5:13
  past Foster City's perimeter in the first place.
• 5:15
  Which brings us to the anatomy of the target.
• 5:18
  Yes. The how and the why. Right. And there's
• 5:21
  a massive geographic irony here. Foster City
• 5:24
  is physically located right in Silicon Valley.
• 5:28
  It's about 30 minutes south of San Francisco.
• 5:30
  It basically serves as the headquarters for major
• 5:33
  tech companies. Yeah, you would assume the proximity
• 5:35
  to tech talent would translate to better municipal
• 5:37
  defenses. Exactly. But they remain highly vulnerable
• 5:41
  and they are not an isolated case. Oakland, San
• 5:44
  Francisco and Hayward have all been battered
• 5:47
  recently. It's a clear pattern. And furthermore,
• 5:50
  just hours after the Foster City attack began,
• 5:53
  the The Los Angeles Metro Service reported unauthorized
• 5:56
  activity that forced them to limit their own
• 5:58
  internal administrative systems. Yeah, the timing
• 6:01
  on that was wild. Right. Customers couldn't see
• 6:04
  arrival times on station monitors or easily add
• 6:06
  value to transit cards online. And LA Metro actually
• 6:09
  enacted a very similar response protocol to Foster
• 6:12
  City. They proactively restricted their internal
• 6:15
  systems to contain the lateral movement. So everyone
• 6:18
  is using the same triage playbook. Pretty much.
• 6:21
  But to address how these attackers are bypassing
• 6:24
  the perimeter, we really have to look past the
• 6:26
  outdated idea of a hacker sitting in a basement
• 6:29
  guessing a password. Right. It's not a movie.
• 6:31
  Exactly. The reporting from GovTech, citing cybersecurity
• 6:35
  incident response manager Jake Tarrant, points
• 6:38
  to a much more systemic issue. Attackers are
• 6:40
  frequently utilizing initial access brokers,
• 6:43
  or IABs. Initial access brokers. Yeah. These
• 6:46
  are specialized groups whose only job is to find
• 6:48
  vulnerabilities. like unpatched virtual private
• 6:52
  network gateways or exposed remote desktop protocol
• 6:54
  instances. They secure a foothold and then they
• 6:57
  literally just sell that access to ransomware
• 6:59
  cartels. Wow. So it's basically an entire supply
• 7:02
  chain for cybercrime. It is. So instead of trying
• 7:05
  to brute force a lock, the ransomware gangs are
• 7:07
  just buying a forged ID badge from a third party
• 7:10
  vendor on the dark web. That's a perfect way
• 7:12
  to put it. And once they authenticate through
• 7:15
  that unpatched VPN, they are inside the perimeter.
• 7:18
  Like a burglar bypassing the front date. Exactly.
• 7:21
  And from there, they aren't just wandering around
• 7:24
  aimlessly. They are actively targeting the domain
• 7:27
  controller. They use tools to scrape credentials
• 7:29
  in memory, aiming to escalate their privileges
• 7:32
  within Active Directory. And if they get those
• 7:34
  admin rights, it's game over. Yep. If they compromise
• 7:38
  an administrator account, they essentially own
• 7:40
  the entire network architecture. They can deploy
• 7:42
  their encryption payload globally across all
• 7:45
  endpoints simultaneously. That is terrifyingly
• 7:48
  efficient. It really is. Right. And if we connect
• 7:51
  this to the bigger picture, you start to see
• 7:53
  why small municipalities are such lucrative targets
• 7:56
  for these tactics. Because of the budgets. Right.
• 7:58
  Tarrant lays out a pretty brutal reality. Local
• 8:01
  governments possess enterprise -level responsibilities.
• 8:04
  I mean, they manage critical utilities, highly
• 8:06
  sensitive human resources files, public infrastructure
• 8:09
  records. Right. Really valuable data. But they
• 8:12
  operate with small business level budgets. They
• 8:14
  simply cannot afford to implement comprehensive
• 8:17
  zero trust architecture or maintain 247 security
• 8:21
  operation centers before an attack occurs. So
• 8:24
  we are talking about a massive systemic resource
• 8:26
  gap. Huge. I know the Department of Homeland
• 8:29
  Security recognized this. They offered $375 million
• 8:32
  in cybersecurity grant funding specifically to
• 8:36
  smaller governments back in 2023. Yeah, which
• 8:39
  sounds like a lot of money. It does. But let's...
• 8:41
  Let's run the math on that. If you spread $375
• 8:43
  million across the roughly 19 ,000 incorporated
• 8:47
  cities and towns in the United States, that averages
• 8:50
  out to less than $20 ,000 per municipality. Which
• 8:53
  gets you basically nowhere. Exactly. That doesn't
• 8:56
  even cover the salary of a junior analyst, let
• 8:58
  alone the deployment of enterprise -grade endpoint
• 9:01
  detection and response software across an entire
• 9:03
  city network. It is fundamentally a drop in the
• 9:05
  bucket. A proper municipal security overhaul.
• 9:08
  You know, segmenting networks, implementing immutable
• 9:11
  backups, migrating to cloud -based identity management.
• 9:14
  That can easily cost a mid -sized city over a
• 9:16
  million dollars. Yeah, $20 ,000 is a joke in
• 9:19
  comparison. So you are putting a local IT department,
• 9:22
  which is historically understaffed and underfunded,
• 9:25
  up against highly organized, well -funded international
• 9:29
  crime syndicates. Syndicates whose entire economic
• 9:33
  model is built on weaponizing these exact budget
• 9:36
  constraints. Which means the attackers are consistently
• 9:39
  getting through. So once they have escalated
• 9:42
  their privileges, mapped the network, and triggered
• 9:44
  the encryption, what actually happens to the
• 9:47
  public's data? That's the messy part. Yeah. And
• 9:50
  how does a city actually claw its way back to
• 9:52
  normalcy? Because for Foster City, the reality
• 9:55
  was stark. Officials issued a warning stating
• 9:58
  that public information may have been accessed.
• 10:00
  Right, which is always the fear. City Manager
• 10:02
  Chatwin had to urge anyone who had done business
• 10:04
  with the city to change their personal passwords,
• 10:06
  and experts recommended freezing credit. And
• 10:09
  that places an enormous burden on the residents.
• 10:12
  But this brings us to a really fascinating shift
• 10:15
  in the cybercrime ecosystem. Oh. Yeah. Jay Caron
• 10:18
  highlights a trend that forces us to reevaluate
• 10:20
  the extortion mechanics entirely. He notes that
• 10:22
  fewer victims are actually paying these ransoms
• 10:24
  anymore. Wait, really? I find that counterintuitive.
• 10:28
  It does seem that way at first. I mean, if a
• 10:30
  cyber cartel exfiltrates highly sensitive internal
• 10:33
  communications or social security numbers from
• 10:35
  a city's HR department, wouldn't the city feel
• 10:38
  immense pressure to pay to stop that data from
• 10:41
  being published? Historically, yes, absolutely.
• 10:43
  Right. But the industry is experiencing what's
• 10:46
  being termed ransomware fatigue. Ransomware fatigue.
• 10:49
  Yeah. The leverage of double extortion, where
• 10:52
  attackers encrypt the network and threaten to
• 10:54
  leak the stolen data, is rapidly diminishing.
• 10:57
  Why is that? Well. The public's data has been
• 11:01
  compromised, leaked, and sold so many times across
• 11:04
  major breaches. You know, at credit bureaus,
• 11:06
  healthcare providers, and telecommunications
• 11:09
  companies. Oh, so everyone's data is already
• 11:11
  out there. Exactly. The threat of exposure just
• 11:13
  doesn't carry the same existential weight it
• 11:15
  did five years ago. Okay, here's where it gets
• 11:16
  really interesting to me. If a city refuses to
• 11:20
  pay because of this ransomware fatigue, what
• 11:23
  actually happens to that data? Does the cartel
• 11:26
  just delete it and walk away? Rarely. The data
• 11:29
  still holds marginal value. If the victim doesn't
• 11:32
  pay, the attackers usually dump the exfiltrated
• 11:36
  data on dark web leak sites. Right. And from
• 11:39
  there, data brokers scrape it, bundle it with
• 11:42
  thousands of other breaches, and sell it in massive
• 11:44
  aggregated packages to other cyber criminals,
• 11:47
  usually for identity theft or targeted phishing
• 11:50
  campaigns. Wow. So it just becomes part of the
• 11:52
  background noise of the dark web. Yeah. But the
• 11:54
  primary extortion leverage, the idea that paying
• 11:57
  the ransom will somehow protect the data, is
• 12:00
  widely recognized as a fallacy now. Victims are
• 12:03
  realizing their data is likely going to end up
• 12:05
  in a multi -breach bundle regardless of whether
• 12:08
  they pay the cartel. That is a profound psychological
• 12:10
  and economic shift. Organizations are essentially
• 12:13
  saying, go ahead and leak it. The damage is already
• 12:16
  priced into our reality. It's a grim acceptance,
• 12:18
  but yeah, that's exactly it. But even if they
• 12:20
  refuse to pay the ransom, the city still has
• 12:22
  to deal with a deeply compromised infrastructure.
• 12:24
  So what does this all mean for the actual recovery
• 12:26
  timeline? It's not a quick fix, I can tell you
• 12:29
  that. Right. In Foster City, the phone and email
• 12:32
  systems were finally restored around March 29,
• 12:35
  which was 10 days after the initial freeze, 10
• 12:37
  days without standard municipal communication.
• 12:40
  And 10 days is just to get the core communication
• 12:42
  layers back online. Tarrant notes that a return
• 12:45
  to complete operational normalcy usually takes
• 12:48
  three to six weeks. Wow. Why does the forensic
• 12:51
  cleanup take so long? I mean, if they have backups,
• 12:54
  why can't they just wipe the servers, reimage
• 12:57
  the machines, and restore the network over a
• 13:00
  weekend? Because you have to assume the attackers
• 13:02
  left persistence mechanisms behind. A backdoor.
• 13:05
  Exactly. You can't just restore from a backup
• 13:07
  and flip the switch. Because if you haven't identified
• 13:10
  exactly how they breached the perimeter in the
• 13:12
  first place. Whether it was that unpatched VPN
• 13:14
  gateway or compromised vendor credentials. Right.
• 13:17
  If you don't find that, they will simply use
• 13:19
  the same. back door to reinfect the restored
• 13:22
  network within hours oh man that would be devastating
• 13:25
  it happens so the forensic teams have to meticulously
• 13:28
  comb through server logs isolate the initial
• 13:31
  attack vector patch the vulnerability and scrub
• 13:34
  every single endpoint for hidden malware or dormant
• 13:37
  scheduled tasks and only then can they begin
• 13:40
  a phased restoration exactly resilience relies
• 13:43
  on strict prioritization you don't bring everything
• 13:46
  online at once foster city prioritized emergency
• 13:49
  dispatch then moved to internal communications
• 13:52
  and pushed public -facing portals to the end
• 13:54
  of the queue It really highlights how critical
• 13:57
  architectural resilience is before the breach
• 13:59
  ever happens. Proactive defense is everything.
• 14:02
  Yeah. If you are a municipality or an organization
• 14:04
  trying to defend against this, the reporting
• 14:07
  points to several non -negotiable strategies.
• 14:09
  First, your backups cannot be accessible from
• 14:12
  your primary network domain. This is huge. Because
• 14:15
  if your backups are mapped to the same Active
• 14:17
  Directory environment, the ransomware will just
• 14:19
  encrypt those too. They must be immutable or
• 14:21
  physically air -gapped. Right. And this raises
• 14:24
  an important requirement for rapid triage protocols
• 14:26
  as well. Organizations need to know exactly who
• 14:30
  has the administrative authority to sever the
• 14:33
  network connection to the Internet at 3 a .m.
• 14:35
  on a Sunday. Right. You can't be calling a board
• 14:37
  meeting in the middle of the night. Exactly.
• 14:40
  Delaying that decision by even an hour while
• 14:42
  waiting for executive approval can mean the difference
• 14:45
  between a single compromised server and a totally
• 14:48
  encrypted domain. And finally, you have to transition
• 14:52
  toward zero -trust architecture. We can't rely
• 14:55
  on the old model of a hard perimeter and a soft
• 14:57
  interior. The Castle and Moat model is dead.
• 15:00
  Yeah. Every user, every device, and every application
• 15:04
  needs to continually authenticate and prove it
• 15:06
  has authorization to access specific data. That
• 15:09
  limits the lateral movement we discussed earlier.
• 15:11
  This exploration of the Foster City attack really
• 15:14
  maps out the realities of the modern threat landscape.
• 15:17
  It is not just about nation states attacking
• 15:19
  critical infrastructure. It is about local transit
• 15:22
  agencies and city councils fighting for the basic
• 15:25
  operational capacity to function. Right. The
• 15:27
  attack surface has expanded to every organization
• 15:30
  that relies on digital connectivity, making localized
• 15:33
  resilience the most critical factor in mitigating
• 15:36
  these disruptions. Which leaves us with a final
• 15:38
  unsettling thought to consider. Oh, I'm ready.
• 15:41
  We explored this concept of ransomware fatigue
• 15:43
  earlier. The reality that victims are increasingly
• 15:46
  refusing to pay because the threat of data exposure
• 15:49
  has lost its leverage. So if this trend continues,
• 15:53
  how will the economics of these cyber cartels
• 15:55
  adapt? They are highly organized businesses that
• 15:58
  need revenue to sustain their operations. They
• 16:00
  won't just give up. Right. If they can no longer
• 16:03
  reliably extort organizations by holding data
• 16:06
  hostage, will we see a shift in their methodologies?
• 16:09
  That is the big question. Could we see a rise
• 16:11
  in purely destructive attacks where cartels deploy
• 16:14
  wiper malware to permanently destroy data and
• 16:18
  brick hardware, extorting entities through the
• 16:20
  threat of absolute operational destruction rather
• 16:24
  than data theft? It's a dark evolution of the
• 16:26
  threat model, but security professionals are
• 16:28
  already bracing for it. Yeah, it's definitely
• 16:30
  something to think about. To ensure your own
• 16:32
  business or organization doesn't end up structurally
• 16:35
  compromised, disconnected, and relying on analog
• 16:38
  workarounds to survive a month -long recovery,
• 16:41
  you need to proactively secure your architecture.
• 16:43
  Don't wait until you're breached. We highly recommend
• 16:46
  you visit www .kinsoft .com .au to discuss your
• 16:50
  security and IT needs before an initial access
• 16:53
  broker tests your perimeter. Great advice. Thank
• 16:56
  you for joining us for this analysis. Until next
• 16:58
  time. ensure your backups are immutable, rigorously
• 17:01
  patch your edge devices, and build your networks
• 17:03
  assuming the perimeter has already been breached.
• 17:06
  Take care, everyone.