The attack on NZZ and CH Media
Around March 24, 2023, the Play ransomware group infiltrated the IT systems of the Neue Zürcher Zeitung, one of the oldest and most respected newspapers in Switzerland, and within hours large parts of the infrastructure were inoperable. The NZZ could not produce a complete print edition for several days, editorial systems were disrupted, and digital workflows failed. Play is the same group that had previously attacked the City of Oakland and cloud provider Rackspace, which places this incident in a broader context of their operations.
What makes this case particularly relevant for the Swiss business landscape is that NZZ and CH Media (Watson, various regional newspapers, AZ Medien) were operating a joint IT venture with shared infrastructure at the time of the attack. The attackers therefore did not need to compromise two organizations separately but could move freely through the systems of both organizations after gaining initial access.
Shared infrastructure as a risk factor
The joint IT infrastructure of NZZ and CH Media encompassed shared servers, shared networks, and likely shared admin accounts as well. While this arrangement is entirely understandable from a business perspective (cost reduction, economies of scale, centralized management), it proved to be a serious security problem because it allowed the attackers to move laterally between organizations without encountering any segmentation boundaries or additional authentication requirements.
After the incident, NZZ and CH Media separated their IT infrastructure, which indicates that management recognized the risk. Prior segmentation of the networks and separation of admin accounts would have very likely contained the damage to one of the two organizations.
Data exfiltration and extortion
Play follows a double extortion strategy in which data is first exfiltrated and then the systems are encrypted. If the victim does not pay, the stolen data is published on the groups leak site on the dark web.
NZZ and CH Media decided not to pay the ransom, which is consistent with the recommendations of most security authorities including the Swiss BACS. The consequence, however, was that approximately 5 GB of data was published on Play’s leak site, including employee data, financial documents and internal communications. While 5 GB may seem like a relatively small volume, even individual documents such as salary lists or confidential correspondence can cause considerable damage.
The BACS (then still NCSC) was involved in the response effort. System recovery took weeks to months in some cases.
Attack path and security controls
The Play group operates according to a documented pattern consisting of several phases. At each individual phase, established security controls could have stopped the attack or at least limited the damage.
Step 1: Initial access via phishing
Play typically uses phishing emails as an entry vector, where an employee clicks a crafted link and thereby compromises their account. Email security gateways with sandbox analysis, properly configured SPF/DKIM/DMARC and regular awareness training (not as a once-yearly event but as an ongoing process) significantly reduce this risk.
Step 2: Credential compromise
After the initial access, credentials are harvested from memory, Kerberos tickets and saved browser passwords are extracted. Multi-factor authentication on all systems and accounts without exception, combined with privileged access management, would have severely limited the usefulness of the stolen credentials.
Step 3: Lateral movement
The attackers moved from system to system and from CH Media to NZZ without encountering segmentation boundaries or triggering alerts on lateral movement. Network segmentation following zero trust principles with separate admin accounts per organizational unit would have prevented this uncontrolled spread.
Step 4: Privilege escalation
The path from a regular user account to domain admin is the critical step for attackers, as domain admin rights provide virtually unrestricted access to the entire infrastructure. PAM solutions with just-in-time access (admin rights are granted only when needed and for a limited time) along with active monitoring of privilege escalation attempts serve as countermeasures here.
Step 5: Data exfiltration
The exfiltration of 5 GB of data likely occurred over several days or weeks in small, inconspicuous batches. Data loss prevention, egress monitoring and anomaly detection would have made this data outflow visible; 5 GB leaving the network toward unknown endpoints should trigger alerts in a properly configured monitoring setup.
Step 6: Ransomware deployment
Only after everything was prepared was the actual encryption rolled out, affecting editorial systems, printing systems and servers. EDR on all endpoints, immutable backups (which therefore cannot be encrypted alongside the primary systems) and application whitelisting would have either prevented the damage or reduced it to a minimum.
Step 7: Double extortion
The demand followed the typical pattern: pay the ransom or the exfiltrated data will be published. A prepared incident response plan with clear responsibilities, a communication plan for internal and external stakeholders, and legal counsel with experience in cyber incidents are the relevant measures here. The response by NZZ and CH Media, choosing not to pay, involving the BACS and communicating transparently, can serve as a reference for other affected organizations.
Context: wave of attacks on Swiss IT service providers in 2023
The NZZ case was not an isolated event but part of a broader wave of attacks that hit multiple Swiss IT service providers in 2023 and exposed a systemic risk in the Swiss IT landscape.
In June 2023, Xplain was compromised, an IT service provider for the Swiss federal government. 900 GB of data was stolen and published, including police data from fedpol, information about ongoing proceedings and sensitive government records. The political consequences were considerable and the investigation continues to this day. In November 2023, Concevis was hit, another federal government IT provider, with tax data and sensitive administrative information affected.
The common pattern across these attacks is that instead of targeting the actual organizations directly, the attackers compromised their IT service providers and thereby gained access to the data of dozens of clients simultaneously. This supply chain approach is particularly efficient because a single compromised provider enables access to a large number of organizations.
BACS reports steadily increasing attack numbers targeting Swiss organizations. The combination of high purchasing power, many SMEs with limited security budgets and highly interconnected IT supply chains makes Switzerland an attractive target for ransomware groups.
Recommendations
Segment shared infrastructure: Organizations that share IT infrastructure with partners or subsidiaries should segment it logically and where possble physically, with separate admin accounts and separate authentication domains per organizational unit.
Treat IT service providers as attack surface: The security concepts and access rights of external IT service providers must be reviewed regularly, including the question of which rights they use to access which systems and how they secure their own infrastructure.
Enable MFA comprehensively: Multi-factor authentication should be enabled on all systems, accounts and remote access points without exception, including the accounts of IT service providers and contractors.
Validate backup strategy: Backups must be immutable, include offline copies and be regularly verified through actual restore tests; a backup that has never been tested is not a reliable backup.
Implement monitoring: A data outflow of 5 GB over several days must be detected in a professional monitoring setup. EDR, SIEM and anomaly detection provide the technical foundations for this, but it also requires personnel who evaluate the alerts and respond to them.
Prepare incident response: Responsibilities, communication channels and the decision on the ransom question should be clarified before an incident occurs, not during the attack at three in the morning..
Do you share IT infrastructure with partners or rely on critical IT service providers? Contact us for an assessment of your security posture.
Sources:
– NZZ: What you need to know about the cyberattack on NZZ
– SRF: NZZ and CH Media hit by ransomware attack
– BACS (formerly NCSC): Federal Office for Cybersecurity
– Watson: Cyberattack on NZZ and CH Media