The UK’s National Health Service (NHS) has experienced its worst ever ransomware attack, with the infection rapidly spreading to multiple NHS trusts taking computer systems out of action and forcing hospitals to cancel operations.

The attack occurred on Friday and affected as many as 40 hospital trusts, causing chaos. The NHS has been working around the clock to bring its computer systems back online and to recover encrypted data.

The massive ransomware attack involved Wanna Decryptor 2.0 ransomware or WannaCry/WanaCryptor as it is also known. There is no known decryptor.

The attackers were threatening to delete data if the ransom was not paid within 7 days, with the ransom amount set to double in three days if payment was not made. The ransom demand was reportedly $300 (£230) per infected machine. NHS Trusts saw the ransomware infection rapidly spread to all computers connected to their networks.

While the NHS was one of the early victims, the attack has spread globally with the Spanish telecoms company Telefonica also hit, along with FedEx, Universities in China, the German Rail operator and the Russian Interior Ministry. Infections are still spreading globally at an alarming pace.

Avast has reported there have been at least 57,000 worldwide infections in 100 countries. Infections are expected to grow over the next few days. This is already the largest ransomware attack in history, according to Mikki Hypponen of F-Secure.

The Department of Health and Human Services and the Department of Homeland Security have issued alerts about the threat, with the HHS saying yesterday there is evidence of the attack affecting U.S organizations.

Laura Wolf, Critical Infrastructure Lead at the HHS advised all healthcare organizations to “exercise cyber security best practices – particularly with respect to email.”

While the ransomware variant has been spread via spam email, the massive global attack is believed to have involved an exploit called ETERNALBLUE. The exploit was released by Shadow Brokers last month, after allegedly being stolen from the NSA. The exploit has been combined with a self-replicating payload that spreads without any user action required.

The exploit is for a vulnerability in Server Message Block 1.0 (SMBv1), which was patched by Microsoft in March, 2017 (MS17-010).

Any organization that has not yet installed the patch is advised to do IMMEDIATELY.

The post Massive Ransomware Attack Hits NHS: Global Warning Issued as Attacks Spread appeared first on HIPAA Journal.

Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) has issued an alert about an emerging sophisticated campaign affecting multiple industry sectors.

The attacks have been occurring for at least a year, with threat actors using stolen administrative credentials and certificates to install multiple malware variants on critical systems. A successful attack gives the threat actors full access to systems and data, while the methods used allow the attackers to avoid detection by conventional security solutions.

While many organizations have been attacked, one of the main targets has been IT service providers. Gaining access to their systems has allowed the actors to conduct attacks on their clients and gain access to their environments. The method of attack allows the actors to bypass conventional monitoring and detection tools and, in many cases, results in the attackers gaining full access to networks and stored data.

NCCIC is still investigating the campaign so full information is not yet available, although an advance warning has been issued to allow organizations to search for signs of a potential system compromise and take appropriate action to mitigate risk.

While multiple tactics, techniques and procedures are used in the campaign, credentials primarily are stolen using malware. Those credentials are then used to gain access to business environments. Once access has been gained, the attackers use PowerShell for reconnaissance, to assess business networks and move laterally within those networks.

Communication with the C2 uses RC4 cipher communications over port 443; however, the domains frequently change IP address, with domains commonly spoofed to make them appear as Windows update sites and other legitimate domains.

While many malware variants are used by the threat actors two of the most common variants are the REDLEAVES remote administration Trojan (RAT) and the sophisticated Remote Access Tool (RAT) PLUGX/SOGU, both of which are executed via DLL side-loading.

REDLEAVES is capable of passing a range of information about the user’s system and allows the attackers to run commands on the infected system. PLUGX provides the attackers with complete C2 capabilities including the ability to take screenshots and silently download files with all C2 communications encrypted to prevent detection.

NCCIC has compiled and published indicators of compromise (IOCs) to allow organizations to identify intrusions and malware infections. Organizations have been advised to continuously analyse their systems for those IOCs via their normal intrusion detection systems.

It may not be possible for organizations to prevent their systems from being attacked, but if appropriate defences are put in place it will make it much harder for the threat actors to infiltrate systems and operate undetected. NCCIC says no single set of defensive techniques will avert malicious activity; however, adopting a multi-layered approach to security will allow organizations to construct an effective barrier to prevent attacks.

IOCs, details of the attack methods and suggested mitigations are available for download from NCCIC on this link.

The post NCCIC Warns of Highly Sophisticated Campaign Delivering Multiple Malware Variants appeared first on HIPAA Journal.