Cyberattacks Against Healthcare Industries

Cyberattacks Against Healthcare Industries

The healthcare industry is one of the world’s largest and fastest-growing critical industries. Amid the Coronavirus pandemic, the healthcare industry endured a rapid digital transformation. Sensitive information from healthcare companies, such as personally identifiable information (PII), personal health information (PHI), personal health record (PHR), lab results, test reports, and research data are extremely valuable to cybercriminals. Due to the value of such data, threat actors targeted scientists, researchers, business logistics firms, and distribution networks using a variety of threat tactics, like disrupting vaccine supplies, for economic gain or geopolitical advantage.

Recommendations

• Enable risk-based authentication (RBA) for the devices used by the employees who need to access data remotely.
• Enable multi-factor authentication for all of your organization accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account.

Standing Intelligence Requirements

Details

Top Cyber Attacks

One of the top cyberattacks that affected the healthcare industry was in 2020 against the British drugmaker, AstraZeneca. AstraZeneca was in the race to deploy a COVID-19 vaccine when threat actors targeted AstraZeneca employees working on COVID-19 research. The attackers used social engineering tactics to break into the drug manufacturer's network, where they impersonated recruiters and approached AstraZeneca employees with fake job offers via social networking platforms like LinkedIn and WhatsApp. Security researchers suspect the involvement of the North Korean threat actors based on the tactics, techniques, and procedures (TTPs) used in the attack. According to reports, the attackers were not thought to have been successful.

In December 2020, cybersecurity researchers uncovered a spear-phishing campaign targeting executives at organizations that support the Cold Chain Equipment Optimization Platform (CCEOP) program started by Gavi, the vaccine Alliance, which assists vaccine distribution around the globe. The attackers impersonated business executives from Haier Biomedical, a Chinese company, serving as a qualified supplier for the CCEOP program, in coordination with the World Health Organization (WHO), UNICEF, and other U.N. agencies. It remains unclear to the researchers whether the phishing campaign was successful.

In March 2021, a Chinese-state-sponsored actor group, APT10, also known as Stone Panda, targeted the IT systems of two Indian COVID-19 vaccine makers: Bharat Biotech and Serum Institute of India (SII). The attackers discovered security vulnerabilities in the IT infrastructure and supply chain software used by these vaccine makers. Security researchers revealed that the motivation was to steal the intellectual property, which could have helped the threat actors get a competitive advantage over Indian pharmaceutical companies.

Another attack was against the US pharmaceutical giant, ExecuPharm. The pharmaceutical firm suffered a data breach and ransomware attack after being targeted by phishing emails sent to employees. The attackers encrypted the ExecuPharm servers, stole corporate and employee data, and sought payment in return for a decryption key.

Top Vulnerabilities

Critical vulnerabilities in various technologies pose a severe threat to the healthcare industry. According to research conducted by the Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC), a vulnerability in Citrix and vulnerabilities in VPN products from Pulse Secure, Fortinet, and Palo Alto are widely used by various APT groups against medical industries. The details are listed below:

Citrix:

• CVE-2019-19781: Citrix Application Delivery Controller And Gateway Code Execution

Pulse Connect Secure:

• CVE-2019-11510: Pulse Connect Secure Information Disclosure
• CVE-2019-11539: Pulse Connect Secure And Pulse Policy Secure Command Execution

Fortinet:

• CVE-2018-13379: FortiOS Vpn Web Portal Directory Traversal
• CVE-2018-13382: FortiOS Security Bypass
• CVE-2018-13383: FortiOS Denial of Service

Palo Alto:

• CVE-2019-1579: PAN-OS Code Execution

These security flaws are classified as critical and exploits for these vulnerabilities are available in the public domain.

The Chinese-state-sponsored threat actor group APT10 was observed attempting to exploit Windows Zerologon vulnerability in attacks. Tracked as CVE-2020-1472, Zerologon is a critical vulnerability that allows attackers to execute arbitrary code with escalated privileges on a vulnerable system.

Other vulnerabilities used by various APT groups against healthcare industries are listed below:

• CVE-2020-11023: Jquery Cross-Site Scripting
• CVE-2019-11358: Jquery Cross-Site Scripting
• CVE-2020-11022: Jquery Cross-Site Scripting
• CVE-2015-9251: Jquery Cross-Site Scripting
• CVE-2018-0802: Microsoft Windows Code Execution
• CVE-2017-11151: Synology Security Bypass
• CVE-2019-16920: D-Link Code Execution
• CVE-2019-1652: Cisco Small Business Routers Command Execution
• CVE-2019-1653: Cisco Small Business Routers Information Disclosure
• CVE-2019-16278: Nostromo Httpd Directory Traversal
• CVE-2020-10189: Manageengine Desktop Central Code Execution
• CVE-2017-0213: Microsoft Windows Com Aggregate Marshaler Privilege Escalation
• CVE-2019-1458: Microsoft Windows Win32k Component Privilege Escalation
• CVE-2015-1701: Microsoft Windows System Token Privilege Escalation
• CVE-2020-0796: Microsoft Server Message Block (Smbv3) Code Execution
• CVE-2019-18935: Progress Telerik Ui For Asp.Net Ajax Code Execution

Top Threat Actors and Groups

Several threat actor groups have targeted healthcare industries in the past. Some of the well-known groups are listed below along with their known or suspected country of origin and attack methods.

APT10 (Stone Panda):

• Country: China (State-sponsored)
• Attack Methods: Malware, Exploiting vulnerabilities in the web applications/systems.

APT1 (PLA Unit 61398):

• Country: China
• Attack Methods: Malware, Exploiting vulnerabilities in the web applications/systems.

APT41 (Double Dragon):

• Country: China
• Attack Methods: Malware, Passive backdoor, Exploiting vulnerabilities in the web applications/systems.

APT35 (Charming Kitten):

• Country: Iran
• Attack Methods: Malware, Exploiting vulnerabilities in the web applications/systems.

APT28 (Fancy Bear):

• Country: Russian Federation
• Attack Methods: Malware, Spear-phishing, Mimikatz, Core-shell.

Other than APT groups, some data brokers sold remote access exploits in various cybercriminal underground networks and forums, which can be utilized by threat actor groups or attackers to get access into a network. ZeroFox Threat Intelligence observed one example of an actor on a Russian-speaking cybercriminal forum advertising the sale of remote access exploits, targeting pharmaceutical companies, among other industries.

Figure 1: A data broker selling exploit kits of pharmaceutical companies on a Russian-speaking forum

Source: ZeroFox Threat Intelligence

Motivation

Over the last year, due to the COVID-19 pandemic, a significant rise in cyberattacks has been observed against healthcare industries, specifically the vaccines manufacturers and pharmaceutical companies. Vaccine manufacturers across the globe were in a race to develop a vaccine for the COVID-19 virus, which gave threat actors several opportunities to leverage cyber threats against targets. Threat actors quickly utilized the pandemic and related fears to lure victims into phishing schemes and malware attacks. In the middle of July 2020, there were multiple reports of cyberattacks to steal COVID-19 vaccine data from the organizations that were involved in vaccine development. The motive behind most of the attacks was financial gain. However, some of the state-sponsored targeted attacks against vaccine manufacturers were to steal intellectual property and slow down vaccine distribution, indicating that financial gain was not the only motive behind the attack.

Intended Effect

According to cybersecurity researchers, the primary target of these attackers is the intellectual properties of organizations. It can harm the competitive advantage and, therefore, the financial foundation of businesses. Apart from the financial gain, some targeted attacks focus on slowing down or disrupting vaccine distribution.

Credential harvesting is also one of the goals of attackers. Stolen credentials allow threat actors to move laterally through a network, conducting surveillance and accumulating additional confidential information from the victim’s environment for future operations.