Minnesota's Winona County Suffers Second Crippling Ransomware Attack This Year
Winona County, Minnesota Declares State of Emergency After Second Ransomware Attack in 2026
Related Entities
Organizations
Other
Full Report
Executive Summary
Winona County, Minnesota, has declared a local state of emergency following a debilitating ransomware attack detected on April 7, 2026. This marks the second time the county has been significantly impacted by a cyberattack in 2026, highlighting the persistent threat facing local governments. The attack has forced the county to take numerous systems offline, disrupting public services and forcing a reliance on manual processes. The severity of the incident prompted Minnesota Governor Tim Walz to authorize the deployment of the Minnesota National Guard's cybersecurity team to support containment and restoration efforts. The FBI is also involved in the ongoing criminal investigation. This event underscores a troubling trend of cybercriminals repeatedly targeting local government entities, which are often under-resourced yet responsible for critical public services.
Threat Overview
The incident has been identified as a ransomware attack. Upon detection, county officials enacted their incident response plan, which involved taking affected systems offline to prevent the malware from spreading further across the network. This containment measure, while necessary, has led to a significant disruption of government operations. Many services that require connectivity to state networks, such as the Department of Motor Vehicles (DMV) and Vital Statistics, are completely unavailable. Other functions are being handled with pen and paper, causing significant delays. Emergency 911 services have reportedly remained operational. A preliminary investigation indicates that this attack was carried out by a different cybercriminal group than the one responsible for the January 2026 incident, suggesting the county is being targeted by multiple, independent threat actors.
Technical Analysis
Specific details about the ransomware variant or the initial access vector have not been released due to the active investigation. However, the attack likely followed a common ransomware lifecycle.
- Initial Access: Common vectors for local governments include successful phishing campaigns (
T1566 - Phishing), exploitation of vulnerabilities in public-facing services like VPN or RDP (T1133 - External Remote Services), or the use of stolen credentials. - Persistence and Discovery: After gaining a foothold, the attackers would have established persistence and begun exploring the network to identify high-value targets like domain controllers, file servers, and backup systems.
- Credential Access: The actors would have used tools to escalate privileges and harvest credentials (
T1003 - OS Credential Dumping) to facilitate lateral movement. - Impact: The final stage involved deploying ransomware across the network to encrypt files (
T1486 - Data Encrypted for Impact) and potentially exfiltrating sensitive data to be used in a double-extortion scheme.
MITRE ATT&CK Mapping
T1486 - Data Encrypted for Impact: The primary action causing the disruption of county services.T1489 - Service Stop: Critical government services were stopped as a direct result of the attack and containment efforts.T1490 - Inhibit System Recovery: It is highly likely the attackers attempted to delete or encrypt backups to hinder restoration.T1133 - External Remote Services: A frequent initial access vector for ransomware attacks against government entities.
Impact Assessment
The cyberattack has had a severe impact on the residents and operations of Winona County.
- Disruption of Public Services: Key services, including the DMV and Vital Statistics, are completely offline. This prevents citizens from conducting essential business like renewing licenses or obtaining official records.
- Operational Setback: County employees have been forced to revert to inefficient and error-prone manual processes, significantly slowing down government functions.
- Economic Cost: The cost of recovery will be substantial, including expenses for cybersecurity experts, the National Guard deployment, potential system replacements, and overtime for staff.
- Erosion of Public Trust: Being successfully attacked twice in one year can damage public confidence in the county's ability to protect its data and maintain essential services.
- State-Level Response: The incident was severe enough to require the intervention of the state governor and the deployment of a specialized National Guard unit, indicating a major crisis for the county.
Cyber Observables for Detection
General observables for detecting ransomware pre-cursors and activity include:
| Type | Value | Description | Context | Confidence |
|---|---|---|---|---|
| command_line_pattern | powershell.exe -enc |
Attackers frequently use encoded PowerShell commands to download tools or execute malicious code. | Process monitoring with command-line logging. | high |
| process_name | PsExec.exe |
Use of remote administration tools like PsExec for lateral movement across the network. | EDR, Process monitoring logs. | high |
| event_id | 4720 |
Creation of a new user account, especially with administrative privileges, can be a sign of persistence. | Windows Security Event Log on Domain Controllers. | medium |
| log_source | VPN Logs |
A high number of failed login attempts followed by a successful one from an unusual location can indicate a brute-force or password-spraying attack. | VPN appliance logs, SIEM. | medium |
Detection & Response
- Endpoint and Network Monitoring: Deploy EDR solutions to detect suspicious processes, command-line activity, and lateral movement. Monitor network traffic for unusual data flows or connections to known malicious IPs.
- Credential Monitoring: Actively monitor for credential dumping activity (e.g., access to
lsass.exe) and the creation of new, unauthorized administrative accounts. - Log Analysis: Centralize and analyze logs from critical systems, especially domain controllers and VPN concentrators, to detect early signs of compromise. This aligns with D3-DAM: Domain Account Monitoring.
Mitigation
For local governments, which are frequent targets, a defense-in-depth strategy is crucial.
- Patch Management: Aggressively patch all internet-facing systems and software to close known vulnerability gaps. This is a fundamental aspect of D3-SU: Software Update.
- Multi-Factor Authentication (MFA): Enforce MFA on all remote access services (VPN, RDP) and for all privileged accounts. This is one of the most effective controls against credential-based attacks, as described in D3-MFA: Multi-factor Authentication.
- Immutable Backups: Follow the 3-2-1 backup rule: three copies of your data, on two different media, with one copy off-site and immutable (unable to be altered or deleted).
- Network Segmentation: Segment the network to prevent attackers from moving freely from a compromised workstation to critical servers. Isolate critical services from the general user network.
- Security Awareness Training: Since the first attack in January did not prevent a second, it's critical to re-evaluate and enhance security awareness training to help employees identify and report phishing and other social engineering attempts.
Timeline of Events
MITRE ATT&CK Mitigations
Enforce MFA for all remote access, privileged accounts, and sensitive applications to prevent credential-based takeovers.
Mapped D3FEND Techniques:
Ensure critical data is backed up to an immutable, offline location to enable restoration without paying a ransom.
Segment the network to contain intrusions and prevent ransomware from spreading from workstations to critical servers.
Mapped D3FEND Techniques:
Maintain a rigorous patch management program to close vulnerabilities in internet-facing systems before they can be exploited.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
For a government entity like Winona County, which has been hit twice, the immediate and most critical defense is the universal enforcement of Multi-factor Authentication (MFA). This must be applied non-negotiably to all remote access points (VPN, RDP), all cloud services (e.g., Microsoft 365), and, most importantly, all privileged accounts (Domain Admins, local administrators). Since ransomware actors heavily rely on stolen or weak credentials for initial access and lateral movement, MFA acts as a powerful barrier. Even if an employee's password is phished or guessed, the attacker cannot proceed without the second factor. Given that this is the second attack, it's highly probable that a credential-based compromise was a factor in one or both incidents. Implementing phishing-resistant MFA, such as FIDO2 security keys, would provide the highest level of assurance and directly mitigate the most common ransomware intrusion vectors.
Implement robust Local Account Monitoring across all servers and workstations. After initial access, ransomware operators often create new local administrator accounts for persistence or use tools like Mimikatz to dump credentials from memory. Security teams in Winona County should use an EDR or SIEM to generate high-priority alerts for specific Windows Event IDs, including 4720 (A user account was created), 4732 (A member was added to a security-enabled local group, especially 'Administrators'), and 4738 (A user account was changed). Baselining normal administrative activity is key; any account creation or privilege escalation outside of a scheduled change window should be treated as a potential indicator of compromise and trigger an immediate investigation. This provides an opportunity to detect and evict an attacker during the lateral movement phase, before they can achieve widespread impact.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats