Ransomware
Vanderbilt hit by BYOD: check endpoints, Box and OneDrive
BYOD's attack on Vanderbilt renamed files to .byod and reached cloud storage. What is confirmed, and what to check in Intune, AD, Box and Microsoft 365.
On Monday, November 9, Vanderbilt University told students, faculty and staff to shut down university devices and disconnect from campus Wi-Fi while it contained "an active cybersecurity incident that may impact university devices, systems, and cloud-based services." By 7:15 p.m. Wi-Fi was back, but most university systems and applications stayed restricted, and the university said it was working with government agencies. Vanderbilt Health runs on separate IT systems and says the hospital and clinics were not affected.
The BYOD extortion group claimed the attack on its leak site the same morning, saying it had locked Vanderbilt's databases and taken research data and more than 1 million Social Security numbers (SSNs). Vanderbilt has confirmed none of that. This is the group's third university or academic health system in two weeks, after the University of New Mexico hospital on October 26 and Michigan State on November 1. What is new at Vanderbilt is how much of the damage people reported in cloud storage, which makes it a useful drill for any organisation that syncs user files to Box, OneDrive or Dropbox.
What happened on campus
The leak-site tracker ransomware.live recorded BYOD's Vanderbilt post at 15:50 UTC, which is 9:50 a.m. in Nashville. Faculty were warned first, and the university's first public update is stamped 10:45 a.m. The student paper, The Vanderbilt Hustler, reports that students got the IT department's shutdown notice at 11:26 a.m., about an hour and a half after faculty.
The Nashville Banner describes one employee's screen: a "system update" notice, then a message that old files were being deleted, then a ransom warning, after which every file on the computer carried a .byod extension. The Nashville Scene quotes another user who saw an unexpected update that appeared to come from Vanderbilt IT and rewrote files into the .byod format. Desktops filled with "README" files (one professor counted about 40), and some devices played an audio message saying the network had been compromised by BYOD. BleepingComputer saw a photo of the ransom note, named README_BYOD_31.txt, which points to the group's leak site and a contact on the Session messenger.
Cloud storage was hit too. The Nashville Banner reports that faculty received Box notices saying administrators had deleted files that no administrator had touched. That is a single report. Vanderbilt's own list of warning signs, though, includes "unusual changes to files, folders, or permissions in OneDrive, Box, or other cloud storage", and at an 8:53 p.m. call the IT team said, according to The Hustler, that OneDrive and Dropbox were still compromised, that the Brightspace learning platform and the YES student system were safe, and that people should not sign in to Microsoft services if prompted for credentials.
How one attack reaches laptops and cloud files
Two things in those reports point to how the encryption spread, though Vanderbilt has not said how the attackers got in.
A notice dressed as an IT "system update" fits ransomware delivered through the organisation's own management channel. BYOD's note claims a "takeover" of Vanderbilt's domain controller (DC), the server that runs Active Directory. An attacker with that level of access can edit a Group Policy Object to run a scheduled task on every domain-joined machine, or push a script through an endpoint management tool such as Intune or Configuration Manager. Either way, the payload arrives looking like an ordinary IT job, and every machine in scope runs it. This is an inference from the observed behaviour, not something Vanderbilt has confirmed.
Sync clients then carry the damage upward. OneDrive, Box Drive and Dropbox keep a local folder in step with the cloud copy. When ransomware renames and rewrites files in that folder, the client uploads the new versions and removes the old names, so the cloud copy changes too. That is why the IT team told people to close OneDrive and Dropbox folders. Box notices naming an administrator would point to something else: an account with admin rights acting on files directly, which is worth checking in the Box admin log covered below.
What to check if you run the same stack
1. Endpoint management. In the Intune admin center, open Tenant administration, then Audit logs, and filter for new or changed scripts, apps and assignments in the days before the first ransom note. Intune keeps these logs for one year. In Configuration Manager, review recent deployments under Monitoring. On domain controllers, look for security event 5136 ("A directory service object was modified") where the Class field is groupPolicyContainer. It is only written if Audit Directory Service Changes is enabled and the object's auditing list covers writes, so check that now rather than during an incident.
2. Box. In the Admin Console, open Reports, create a User Activity report, set the date range and select the File Management, Login and Users action types. Exports reach back seven years. In the event stream (GET /events with stream_type=admin_logs), the events to look for are DELETE in bulk from one account, ADMIN_LOGIN (the Admin Console used to log in to a managed user's account), CHANGE_ADMIN_ROLE, CHANGE_FOLDER_PERMISSION and DISABLE_MULTI_FACTOR_AUTH.
3. OneDrive and SharePoint. In Microsoft Purview audit, or with Search-UnifiedAuditLog -Operations FileModified,FileRenamed,FileDeleted,FileDeletedFirstStageRecycleBin, look for one user or device touching hundreds of files in minutes, especially renames to a new extension. FileMalwareDetected is also worth a filter.
4. Identity. Vanderbilt's warning not to enter Microsoft credentials suggests it expected phishing or fake sign-in prompts during the outage. After containment, revoke sessions for every account seen in the bulk activity, rotate any admin and service accounts used for Group Policy, Intune or Box administration, and review MFA changes, as set out in our Michigan State post.
Recovering cloud files, and its limits
Microsoft's Restore your OneDrive rolls a OneDrive back to any point in the last 30 days, and after automatic ransomware detection it suggests a restore date. On a work or school account it is under Settings, then Restore OneDrive. It cannot bring back files permanently deleted from the recycle bin, which is why an attacker clearing the second-stage recycle bin (FileDeletedSecondStageRecycleBin in the audit log) matters. In Box, deleted items go to trash, and admins can see restores as UNDELETE events. Neither is a backup: if the attacker holds an admin account, the same account can shorten retention or purge trash, so keep at least one copy of research and business data outside the tenant it protects.
What BYOD claims, and what to tell people
BYOD's post says it has "your entire estate and research data", more than 1 million SSNs, names, email addresses, phone numbers and student and employee records, and will "take you down" once contact is established. None of this has been verified. The same day, ransomware.live and Gizmodo show the group also listed the Texas Health and Human Services Commission, also unconfirmed.
At UNM the group tried to talk to patients directly with an offer of compensation. Expect similar contact attempts, and fake IT messages, after a campus incident: tell students and staff that IT will never ask for passwords by phone or pop-up, and give them one channel for reporting what they receive, as Vanderbilt did with its service desk number on a separate device.
Our security operations team hunts for mass file changes and admin misuse across Microsoft 365 and Box, and our safeguarding and hardening work locks down the Group Policy, Intune and admin paths ransomware uses to spread. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Vanderbilt University: Nov. 9 cybersecurity incident updates, BleepingComputer, The Vanderbilt Hustler, Nashville Banner, Nashville Scene, WSMV, FOX 17, Gizmodo, ransomware.live: Vanderbilt EDU, Microsoft: Intune audit logs, Microsoft: event 5136, Microsoft Purview audit log activities, Microsoft: Restore your OneDrive, Box: User Activity report, Box: enterprise events.