Q3 2022 Healthcare Sector: Quarterly Threat Landscape Scorecard

Q3 2022 Healthcare Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-12-07b

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Healthcare Sector Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The threat to healthcare sector organizations in Q3 2022 remained broadly consistent with previous quarters, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. In Q3 2022, there were likely increases in particular aspects of the social engineering threat to healthcare organizations, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2.0 (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosure, including in internet-connected medical devices and software commonly used by healthcare organizations, will very likely strain out-of-cycle patch management processes and increases the risk of vulnerabilities not being patched in a timely manner. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers, trojans, and spyware. Digital extortion attempts against healthcare targets remain below 2021 levels, likely caused in part by difficulty eliciting payments from victims. Incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream users.

Key Findings

• Healthcare organizations likely faced an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Vulnerabilities in software commonly used by healthcare organizations were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
• The threat to healthcare organizations from IABs likely increased in Q3 2022.
• The threat from cyber espionage remained high, with multiple campaigns by threat actors—including state-linked actors—identified in Q3 2022.
• Ransomware and digital extortion attempts against the healthcare sector this quarter highlighted the threat of attacks against third-party providers.