Attacks on the Healthcare Industry

This past week, the US-based healthcare company Universal Health Services (UHS) experienced a suspected ransomware attack that forced the IT network across its many facilities and hospitals to be shut down. This advisory addresses the current ransomware threats posed to healthcare based companies and how ransomware can leverage the current pandemic to force companies into paying the ransomware operators more money at the risk of not being able to provide healthcare services.

Recommendations

Always verify the sender of suspicious or unexpected emails and messages
Never download or execute attachments from unknown senders or suspicious emails
If you are in the healthcare industry, ensure you have proper disaster recovery processes and procedures in place
Talk with your account manager about ZeroFOX’s Advanced Email Protection services to ensure suspicious or malicious emails are identified
ZeroFOX customers are advised to closely monitor their darkweb alerts for indications that threat actors could be targeting them

Details

While UHS has not confirmed the cause of the outage to be ransomware and described the event as an “IT security issue”, there are some signs that point to ransomware, more specifically, Ryuk ransomware.

Ryuk is a popular type of crypto-ransomware used by many threat actors and ransomware groups which uses encryption to prevent access to files, systems or devices until a ransom is paid. Typically, ransomware such as Ryuk is deployed using other malware such as TrickBot or Emotet.

While the initial attack vector is unknown, it is assumed by security researchers that the initial infection was delivered through malicious emails. In addition, a news outlets have reported that the files were encrypted with a “.ryk” extension, which would indicate Ryuk.

Attacks like this on hospitals are worrying for countless reasons, especially with the current COVID-19 pandemic. This attack on UHS is also troubling due to the recent incident where a patient died after ransomware crippled a hospital located in Dusseldorf, Germany and forced the patient to travel about 20 miles, resulting in a one-hour delay in treatment.

Many of the ransomware groups tracked by the ZeroFOX Alpha Team on the dark web have specifically stated they would not target hospitals or healthcare providers when the COVID-19 pandemic started. However, several ransomware groups have singled-out pharmaceutical companies saying they wouldn’t exclude them from their targeted sectors meaning healthcare supply chains can also be indirectly impacted by their activities.

Figure 1: Ransomware group stating they will not attack hospitals

So far, 2020 has seen an increase in ransomware attacks targeting the healthcare sector with many threat actors using the current pandemic as leverage, knowing the facilities will need to restore operational capabilities as soon as possible in order to effectively care for their patients. Attacks like these at a larger scale against hospitals and healthcare providers could have severe implications and all due care should be taken to maintain network security for those within this sector.