HHS, FBI, CISA Warn Hospitals of ‘Imminent’ Ransomware Attacks

The Health and Human Services Department, the Cybersecurity and Infrastructure Security Agency and the FBI warn hospitals face an imminent threat from cybercriminals that encrypt and hold their data hostage—and some health care facilities are already dealing with the fallout.

The agencies collectively issued an advisory Wednesday detailing the tactics, techniques and procedures reportedly used against at least five hospitals already this week. The advisory includes recommendations for mitigating what observers are referring to as the most serious cyber threat the U.S. has seen to date, being perpetrated by an especially ruthless group of criminals.  

“CISA, FBI, and HHS have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers,” reads the advisory.

The agencies noted that the situation is made more challenging by the COVID-19 pandemic and said, “administrators will need to balance this risk when determining their cybersecurity investments.” 

Hospitals should establish continuity of operations plans and reach out to nearby hospitals for help with overflow due to limited capacity if attackers are successful in locking up their files, among other recommendations, the agencies said. Last month, a woman in Germany died after being turned away from a hospital under a ransomware attack. The incident marked the first-ever known fatality due to a cyberattack.

“The ransomware campaign against the U.S. health care system is concerning for so many reasons—not least of which is the fact that the U.S. is still very much battling to get the pandemic under control with hospitalizations on the rise in many states,” said Lavi Lazarovitz, director of security research at CyberArk. “We’ve already seen the consequences of attacks like this which could certainly include loss of life—making these particular attacks callous and devastating.”  

Charles Carmakal, senior vice president and chief technology officer of the cyber intel firm Mandiant, said the actions of the group—which he described as an Eastern European threat actor known as UNC1878—are the most heartless and disruptive he’s seen over the course of his career.

The government agencies did not attribute the threat to any particular group but the advisory notes that the Ryuk ransomware involved sometimes included restrictions against targeting specific Eurasia-based systems.

The advisory recommends the usual list of best practices for securing networks. Those include patching systems as soon as fixes are issued, using multifactor authentication where possible, configuring access controls with least privilege in mind, and setting antivirus and anti-malware solutions to automatically update. 

But the attackers are using increasingly advanced techniques, including ones that can disable traditional protections.

“The attackers will attempt to shut down or uninstall security applications on the victim systems that might prevent the ransomware from executing,” the advisory reads. “Normally this is done via a script, but if that fails, the attackers are capable of manually removing the applications that could stop the attack.”

The criminals are also adjusting the way they first access victims’ systems to get around email-filtering technologies, according to a report Mandiant released to the public Wednesday.

Instead of putting a malicious link directly in a phishing email, the criminals have been posing as corporate personnel and including links to other documents that then contain the infectious link.

“Various technologies have the ability to follow links in an email to try to identify malware or malicious domains; however, the number of links followed can vary,” Mandiant’s report notes. “Additionally, embedding links within a PDF document further makes automated detection and link-following difficult.”

To top all this off, the government advisory stresses that decryptors the criminals send to victims in exchange for their ransoms don’t always work.

“Even if run correctly, there is no guarantee the decryptor will be effective,” the advisory reads. “CISA, FBI and HHS do not recommend paying ransoms. Payment does not guarantee files will be recovered. It may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities.”

Ransomware-specific mitigations in the advisory include following a 3-2-1 rule for backing up essential files.

“The rule states that three copies of all critical data are retained on at least two different types of media and at least one of them is stored offline,” the advisory reads. 

Other recommendations include instructions to maintain backup hardware and images to essentially be able to rebuild systems from scratch if necessary. All this would nullify the need to give into attackers monetary demands.

But as Chris Kennedy, chief information security officer of AttackIQ, notes, the pandemic has created a prime environment for the criminals that makes such measures challenging.

“The pandemic has limited non-emergency medical procedures in hospitals and citizens attempting to flatten the curve are avoiding hospital and doctor visits unless absolutely necessary—all of which has resulted in lost revenues and many health care providers now face financial turmoil,” Kennedy, who formerly headed up cyber ops programs for the Treasury Department and the Marine Corps, said. “And unfortunately, when the budget gets tight, security and support functions get whacked.”