09/30/2020
Increase in Ransomware Attacks on Healthcare. Most of us watched on Monday as what may well be one of the largest cyberattacks directed at healthcare in US history became known.
Computer systems for Universal Health Services began to fail over the weekend and some of their facilities have had to resort to pen and paper for creating and filing patient information.
The ransomware used in the attack is a familiar one known as Ryuk. Ryuk was responsible for several incidents in the past year. Ryuk often comes bundled with another kind of malware known as Trickbot. It’s being spread by Emotet, a massive botnet that recently reactivated.
Emotet has been updated with new code that extracts and repurposes email attachments from your contacts to make its spam more convincing. The usual advice of only opening attachments you expect from contacts doesn’t apply.
Emotet been dormant for the last five months. This is normal for Emotet, which tends to take extended breaks every so often. But after this long break, security researchers discovered evidence that Emotet has reactivated itself, and it has dangerously enhanced it capabilities.
Emails detected in recent days include the usual suspects of spam messages and phishing links. But in addition to those, known malware like the Ryuk ransomware and Trickbot are also being included as part of malicious email attachments.
Ryuk is difficult to detect and can be equally problematic to contain because the initial infection usually occurs through spam or phishing. At that point it can propagate and infect not only traditional endpoint devices (laptops, computers, servers) but also IoT and IoMT devices. This has been reported at UHS hospitals with phone systems and radiology machines being locked up. Once on an infected host, it may pull passwords out of memory and then move laterally across open shares impacting documents and compromised accounts.
In the early days of COVID-19, some ransomware operators stated that they would refrain from hitting healthcare organizations. Despite those statements, the number of attacks targeting medical institutions continues to rise.
