TIRANA, July 29 /ATA/ – By I.Vata/ The general director of the National Agency for ICT (AKSHI), Mirlinda Karçanaj, informed on Friday about the situation following the response to the cyberattack.
At the media conference with Deputy Prime Minister Belinda Balluku, and the representative of Microsoft’s special team for cyber security, Kevin Chin, Karçanaj emphasized that after 14 days of coping with the cyberattack, the public administration has returned to normality.
“I am here today to let you know that after 14 days of uninterrupted work, the AKSHI team, local company experts, our partners inside and outside the country, restored the IT system bringing the public administration back to normality and work processes step by step. AKSHI response to this cyber attack has been on two main fronts: the recovery of all critical government systems and infrastructures and, in parallel, the isolation of malicious activity,” she said.
Karçanaj added that AKSHI is working closely with Microsoft partners through their best experts in detection and response to cyber incidents known as “DART Team.”
“The manager of this team is with us today and will take the floor after me. The Dart Team and the Microsoft Threat Intelligence Center have led this forensic investigation, not only remotely, but they have sent the experts here, they are working with us, and this after their assessment of the purpose, but also the complexity of this the attack, which had never happened in the history of our country. The attack types were two: Ransomware and ZeroCleare WipeOut. The first malicious attack started initially in the form of a Ransomware attack, but as far as we know the typical Ransomware aims to encrypt data to then demand ransom in exchange for decryption, but in this case it was not like that, it was Ransomware decoy in. To divert attention from the real objective of the attack, which was actually to wipe out all critical important government systems along with the data on them. Thanks to the quick response of the protection systems and the technical staff, there was no data breach. Despite the fact that the attack was a high degree of sophistication and synchronization against systems and infrastructures, their immediate isolation was carried out by strictly implementing international cyber security protocols and policies, until the full assessment and analysis of the situation. The systems were verified one by one to make sure every element was safe before they were restored,” she said.
Karçanaj said that thanks to the cooperation with partners and the work done by all the staff of AKSHI, 98% of online services have been restored.
/r.e/sm/
