Dallas, Texas was hit by a ransomware attack on Wednesday. Several key city services were disrupted. According to the online publication, BleepingComputer a Royal Ransomware operation was behind the attack on the City of Dallas.

On Wednesday morning, network printers on the City’s network began printing out ransom notes. The IT department warned employees to retain any printed notes.

Dallas is a population center with 1.5 million people within the city limits.  And is the fourth-largest metropolitan area in the United States with over 7.5 million people living in the cluster of adjacent suburban towns. 

The Police Department and City Hall websites were taken down by the hackers. And the disruption caused some jury trials to be canceled. 

According to Dallas Fire-Rescue spokesman Jason Evans, the DFR was running on manual dispatch operations early Monday morning.

The attack did not affect 911 calls, but it did cause issues with the computer-assisted dispatch system used by firefighters.

Ransomware attacks target city governments

Ransomware attacks involve hackers encrypting files on a computer system and demanding payment, usually via Bitcoin, in exchange for the decryption key. These attacks can affect individuals, businesses, municipalities, and governments. 

The city said the attack had only a limited impact on city services, and they were actively working to isolate and remove the ransomware from infected servers.

While the city did not provide more details about the incident, it is clear that ransomware attacks continue to be a growing threat to all types of organizations. 

When critical infrastructure is impacted, lives can be at risk, this makes city services a target for ransomware hacker gangs. 

Emsisoft threat analyst Brett Callow said that "Incidents involving US local governments happen at a rate of more than 1 per week." 

"At least 29 have been impacted by ransomware this year, with at least 16 of the 29 have had data stolen. Most of the incidents involve smaller governments and Dallas is, I think, the largest city to be hit in quite some time," Callow added.

Royal Ransomware 

Royal ransomware operations are an offshoot of the Conti cybercrime syndicate. When Conti shut down Royal appeared.

The group began operations in January 2022. And Royal started out using other ransomware operators' encryptors, such as ALPHV/BlackCat. Later they began using their own encryptor known as Zeon.

Towards the end of 2022, the operation rebranded into Royal. It has quickly become one of the most active enterprise-targeting ransomware gangs.

While Royal breaches networks using vulnerabilities in devices on the internet, they also use callback phishing attacks to gain initial access to corporate networks.

These callback phishing attacks pretend to be food delivery and software providers. 

Instead of containing links to phishing sites, the emails contain phone numbers that the victim can contact to cancel a supposed subscription.  In reality, these phone numbers connect to a service hired by the Royal threat actors.