Netwalker Ransomware Hits Pakistan's Largest Private Power Utility (K-Electric)

 

K-Electric, the sole electricity provider for Karachi, Pakistan, has suffered a Netwalker ransomware attack that led to the disruption of billing and online services.

K-Electric is Pakistan's largest power supplier, serving 2.5 million customers and employing over 10 thousand people.

Starting yesterday, K-Electric customers have been unable to access the online services for their account.

To resolve this issue, K-Electric appears to be trying to reroute users through a staging site, but are currently having difficulties.

Errors accessing account

Ransomware researcher Ransom Leaks, who told BleepingComputer about this attack, was tipped off by a local Pakistani security company that this attack is impacting K-Electric internal services.

According Rewterz, the cyberattack occurred on the morning of September 7th and is disrupting K-Electric's online billing services and not the supply of power.

BleepingComputer has emailed K-Electric about this attack but has not heard back.

Netwalker is demanding a $3.8 million ransom

After being told about this attack, BleepingComputer has learned from cybersecurity sources who wish to remain anonymous that the Netwalker ransomware attacked K-Electric.

In a Tor payment page seen by BleepingComputer, the ransomware operators demand a $3,850,000 ransom payment. If a ransom is not paid within another seven days, the ransom will increase to $7.7 million.

Tor payment page for K-Electric

The Tor payment site also includes a 'Stolen data' page that states the Netwalker operator stole unencrypted files from K-Electric before performing the attack. This page does not reveal how much or what data was stolen.

Tor stolen data page for K-Electric

Since the summer of 2019, Netwalker has been actively infecting victims. It wasn't until March 2020, when the threat actors began recruiting skilled hackers and focusing entirely on enterprise networks, that we began to see widespread attacks.

According to a report by McAfee, this change in tactics has led to the ransomware gang earning $25 million in just five months.

Recent Netwalker attacks include Argentina's immigration offices, US government agencies, and the University of California San Francisco (UCSF), who paid a $1.14 million ransom.