Healthcare organizations in the crosshairs of cyberattackers

In an era where cyber threats continue to evolve, healthcare organizations are increasingly targeted by malicious actors employing multiple attack vectors, according to Trustwave.

In its new research, Trustwave SpiderLabs has documented the attack flow utilized by threat groups, shedding light on their tactics, techniques, and procedures. From phishing emails to exploiting known vulnerabilities and compromising third-party vendors, these persistent threats pose significant risks to the healthcare industry.

Healthcare industry bears heavier financial burden

While the healthcare industry is not alone in facing an elevated threat landscape, the consequences of attacks in this sector can be severe, even fatal. Adversaries are highly motivated by financial gains and continuously refine their techniques to surpass existing defenses. In 2022, the average cost of a data breach in healthcare was $10.1 million, which is more than double the industry average of $4.4 million, according to data from the Ponemon Institute.

“Protecting the supply chain and maintaining business continuity are critical considerations across most industries, but healthcare cyber leaders encounter distinct challenges in safeguarding patient well-being, maintaining quality of care, and enabling healthcare professionals to leverage cutting-edge digital technologies to perform at the highest level,” said Trustwave CISO Kory Daniels. “Our latest threat briefing is a valuable resource for security leaders within the healthcare sector, providing a comprehensive view of the threats observed by our SpiderLabs team, along with specific mitigation strategies to bolster defenses.”

The Trustwave SpiderLabs report analyzes threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. These methods encompass leveraging valid access credentials, exploiting unsecured credentials, and utilizing Webshells.

Additionally, the report identifies specific entry points such as Apache Log4J (CVE-2021-44228) and Spring Core RCE (CVE-2022-22965) vulnerabilities, while highlighting the high activity of prominent ransomware gangs like LockBit and ALPHV/BlackCat targeting healthcare entities.

Emerging and prominent trends

• Artificial intelligence and generative AI: Unique implications and risks due to the sensitive nature of the data potentially being shared with these tools.
• Ransomware groups targeting healthcare: Threat groups previously considered healthcare-related targets off limits, or protected, but are now widely attacked.
• Software vendor and IoT exposure: The risks associated with third-party vendors and the proliferation of Internet of Things (IoT) devices in healthcare further amplifies the potential attack surface and vulnerability of the industry’s infrastructure.

Cybersecurity challenges

• Custom applications: Healthcare organizations rely heavily on custom applications that often lack adequate security testing and code auditing, leading to undiscovered vulnerabilities.
• Third party reliance: Healthcare entities commonly engage with numerous third parties, further expanding the number of endpoints and users involved, thereby contributing to a growing threat surface.
• Internet of Things: The healthcare industry typically has a higher number of connected physical devices, such as heart monitors and imaging hardware, which often prioritize functionality over software security.
• Compliance: Healthcare organizations are often hesitant to implement changes quickly due to concerns about compliance with oversight agencies and compatibility issues with existing software and hardware.
• Patient care: The focus on patient safety and avoiding unexpected disruptions, like system crashes, leads healthcare organizations to be more cautious about adopting software patches or making changes that could jeopardize patient care.

Threat actors and threat tactics

Threat actors:

• LockBit 3.0
• ALPHV/BlackCat
• Clop
• DMA Locker
• Royal
• Babuk
• Magniber
• Black Basta
• RansomHouse

Threat tactics:

• Phishing/BEC
• Vulnerability exploitation
• Logging in with valid credentials (unsecured, default, low complexity, or purchased)
• Existing tools (Powershell, LOLBins)
• Webshells and stolen sessions
• Malware (infostealers, RATs, ransomware)
• DDoS