Health sector mobilizes defenses following Ryuk ransomware warning

Threat briefings are being held for hospital executives, federal officials are appealing for more data and hospitals are hardening their computer networks.

A day after U.S. federal agencies warned of an “imminent” ransomware threat to hospitals, it’s an all-hands-on deck mentality for a health sector already strained by the coronavirus pandemic.

Private threat briefings are being held for hospital executives, federal officials are appealing for more data on the cybercriminals and hospitals are hardening their computer networks.

The defensive measures follow an advisory Wednesday from the FBI and departments of Homeland Security and Health and Human Services that cybercriminals were deploying Ryuk ransomware to disrupt IT networks and extort hospitals. It was a stark warning, even for a health care sector accustomed to pandemic-era cyberattacks: Medical organizations are being singled out by capable crooks.

While the federal agencies did not name victim organizations, the announcement coincided with suspected ransomware attacks this week on hospitals in New York, Oregon and Vermont, and perhaps other states.

The American Hospital Association, which includes 5,000 health care organizations, is in close touch with government agencies in an effort to disseminate threat data to hospitals across the country, said John Riggi, the association’s senior adviser for cybersecurity and risk.

Riggi, a former senior FBI official, urged health care providers to back up their data and expedite patching of technology accessible via the internet. “Hospitals should also be prepared to re-route patients to hospitals outside their area if there is a simultaneous regional outage of multiple-hospital IT systems,” he said.

The public-private coordination includes phone briefings that the FBI, DHS and HHS officials held for health care organizations on Wednesday and Thursday. The federal officials encouraged health care executives to share as much technical data about the attacks as possible, and indicated that the search for victims of the ransomware campaign was ongoing.

Mitch Parker, executive director of information security and compliance at Indiana University Health, said that security experts were hunting for potential ransomware infections at various health care organizations.

“Health care organizations need to make decisions relevant to what services they use that are potentially exposed, putting their networks at risk,” Parker said.

There have been no reports of the ransomware attacks affecting patient safety.

Analysts at FireEye put a name to the criminal gang behind the attacks: UNC1878. The cyber-crooks are based in Eastern Europe, according to FireEye, and have been known to demand tens of millions of dollars in ransom. They are “one of most brazen, heartless and disruptive threat actors I’ve observed over my career,” said Charles Carmakal, a senior vice president at Mandiant, FireEye’s incident response arm.

“We are actively trying to notify health care organizations that are compromised by ransomware operators,” Carmakal said, “in an effort to help them eradicate the threat actor before ransomware is deployed.”

The criminal group is swift in deploying ransomware once inside organizations’ networks, and they have accounted for a large chunk of Ryuk-related intrusion attempts known to FireEye this year.

“This really speaks to the scale of their operation; they’re hustling,” FireEye researcher Van Ta said Wednesday on a webinar hosted by the SANS Institute.

Leading Republicans on the House Energy and Commerce Committee urged the Trump administration to go after the hackers for what they did.

“To attack hospitals, especially during the COVID pandemic, and threaten the health and safety of vulnerable Americans is heartless and cruel. These attackers should suffer the full fury of American capability,” said Oregon Rep. Greg Walden, the top GOP member of the full committee; Washington Rep. Cathy McMorris Rodgers, ranking minority member of the Consumer Protection and Commerce Subcommittee; Kentucky’s Brett Guthrie, top Republican on the Oversight and Investigations Subcommittee; and Texas rep. Michael Burgess, the ranking minority member of the Health Subcommittee.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure