The Biden Administration has announced a long-awaited new national cybersecurity strategy for tackling the growing threat of cyberattacks on critical infrastructure, disrupting cyber threat operations, and improving cyber resilience against malicious cyber activity from cybercriminal groups and nation-state actors. The aim is to ensure a safe and secure digital ecosystem for all Americans and that requires fundamental shifts in roles, responsibilities, and resources in cyberspace and a shifting of the burden of cyber resilience away from individuals, small businesses, and local governments onto the multi-billion dollar technology companies that provide software and information technology.

The new strategy will involve a more intentional, better coordinated, and more well-resourced approach and a realigning of incentives to favor long-term investments in cybersecurity to achieve a better balance between defending against current threats and planning for and investing in a cyber-resilient future. The new cybersecurity strategy sets a path to address current and future threats to protect investments in rebuilding America’s infrastructure, develop the clean energy sector, and re-shore America’s technology and manufacturing base. The aim is to make the digital ecosystem of the United States more defensible and make cyber defense easier, cheaper, and more effective.

The new cybersecurity strategy is based on five pillars:

• Defend Critical Infrastructure
• Disrupt and Dismantle Threat Actors
• Shape Market Forces to Drive Security and Resilience
• Invest in a Resilient Future
• Forge International Partnerships to Pursue Shared Goals

To better defend critical infrastructure the government will expand minimum cybersecurity requirements in critical sectors and harmonize regulations to reduce the burden of compliance. Public-private collaboration will improve at the speed and scale necessary to defend against cyber threats, federal networks will be modernized, and cyber incident response policies will be improved.

The Biden Administration has already taken steps to accelerate efforts to disrupt cyber threat operations and dismantle the infrastructure used in attacks, and all tools of national power will be used to continue that mission. The private sector will be engaged to assist and provide scalable mechanisms to achieve those aims, and the ransomware threat will be tackled through a comprehensive federal approach, assisted by international partners.

Improving security and resilience will not be possible without comprehensive assistance from vendors, who must shoulder more of the responsibility of protecting against cyber threats. Liability for protecting against threats will shift from individuals and companies to the developers of software products and services, and federal grant programs will be introduced to promote investments in secure and resilient infrastructure.

To ensure a resilient future, strategic investments are required in people and technology. Through coordinated, collaborating action, the United States will lead the world in secure and resilient next-generation technologies and will help to reduce systemic technical Internet vulnerabilities, prioritize cybersecurity R&D for next-generation technologies, and develop a diverse and robust national cyber workforce.

International coalitions and partnerships will be forged with like-minded nations to counter cyber threats, the capacity of partners to defend themselves will be increased, and investments will be made to ensure trustworthy global supply chains for IT and communications technology and OT products and services.

“I’m pleased to see the Biden Administration advocating for the kind of best practices that I’ve long called for, such as building and reinforcing strong partnerships with the private sector, investing in the long-term protection of our nation’s critical infrastructure, being proactive about establishing strong cybersecurity foundations and meeting critical standards,” said Senator Mark R. Warner (D-VA), Chairman of the Senate Intelligence Committee.

“I’m particularly pleased to see the Administration prioritize the coordination of cyber incident reporting requirements, as required by the cyber reporting law I was proud to author. I’m also glad to see the Administration’s renewed focus on protecting the sensitive medical data and safety of Americans as cyber attacks on our health care systems become more frequent and aggressive,” added Warner.

“The latest National Cybersecurity Strategy is a strong signal that industry’s continued partnership and collaboration in building resiliency across U.S. critical infrastructure is needed now more than ever. We recognize the importance of rebalancing and enhancing how we collectively defend national interests, privacy, intellectual property, and critical systems in cyberspace,” said Stacy O’Mara, Senior Leader, Global Government Strategy, Policy, and Partnerships, Mandiant.

“Mandiant looks forward to promoting evolution of the private-public partnership model as outlined in the Strategy to compensate for resource-restricted, at-risk sectors and entities that need collective assistance to defend themselves. We see this call to action as a timely opportunity to better align our collective defense to the threat landscape by taking a risk-based approach to prioritize  threats, capabilities, resources, and investments.”

The post Biden Administration Announces New National Cybersecurity Strategy appeared first on HIPAA Journal.

The healthcare and public health (HPH) sector has been warned about cyberattacks involving MedusaLocker ransomware – one of the lesser-known ransomware variants used in cyberattacks on the sector. The HPH sector has been extensively targeted by prolific ransomware groups using ransomware variants such as Clop, Royal, and BlackCat, but attacks involving these lesser-known variants can be just as damaging.

The threat actor behind MedusaLocker is believed to run a ransomware-a-service operation, where affiliates are recruited by the group to conduct attacks for a cut of any profits they generate, which is believed to be around 55%-60% of the ransom payment for MedusaLocker ransomware affiliates. The ransomware variant was first detected in September 2019 and the group is thought to primarily target the HPH sector. Since 2019, the majority of attacks have used phishing and spam emails with malicious attachments as the initial access vector. When the attachments are opened, a connection is made to the command-and-control server, and a script and the ransomware payload are downloaded. Propagation is believed to occur via WMI.

In 2022, the group started to leverage vulnerabilities in Remote Desktop Protocol, and this now appears to be the preferred initial access vector. The group exploits vulnerable RDP services and compromises legitimate RDP accounts using brute force tactics to guess weak passwords. After gaining access to victims’ networks, the group establishes persistence through registry entries, escalates privileges, moves laterally, exfiltrates data, then deploys the ransomware. MedusaLocker ransomware uses a hybrid encryption approach, first encrypting files with an AES-256 symmetric encryption algorithm, then encrypting the secret key with RSA-2048 public-key encryption. Backup copies of encrypted files are deleted to prevent recovery without paying the ransom. While the group behind MedusaLocker has a network of Russian hosts for conducting attacks, the group also leverages U.S. infrastructure, including using the compromised infrastructure of data centers and U.S. universities as redirects to obfuscate their attacks.

The Health Sector Cybersecurity Coordination Center (HC3) explained some of the known tactics, techniques, and procedures used by the group and suggests several mitigation measures. Since the group now favors RDP compromise, it is important to ensure that RDP instances have multiple levels of access and authentication controls. HC3 recommends monitoring RDP utilization, flagging and investigating first-time-seen and anomalous behavior such as failed login attempts, and implementing a robust account lockout policy to defend against brute force attacks.

RDP should never be exposed to the Internet, the patching of RDP vulnerabilities should be prioritized, strong passwords should be set, multi-factor authentication implemented on accounts, and if remote users need to access the corporate network via RDP, a VPN should be used. HC3 also recommends restricting access to the Remote Desktop port to trusted IP addresses and changing the default RDP port from 3389 to another port. To protect against phishing attacks, healthcare organizations should consider disabling hyperlinks in emails and adding a banner to all emails that have been received from an external email address.

You can view the HC3 MedusaLocker Ransomware Analyst Note on this link (PDF)

The post Healthcare Organizations Warned About MedusaLocker Ransomware Attacks appeared first on HIPAA Journal.

In Early February, a zero-day vulnerability in Fortra’s GoAnywhere MFT secure file transfer software (CVE-2023-0669) was exploited in attacks on more than 130 organizations, including several in the healthcare industry such as Community Health Systems (CHS) in Tennessee. That attack affected up to 1 million patients. Fortra issued an alert about the vulnerability in early February when it was discovered to have been exploited in attacks and issued workarounds to prevent exploitation ahead of an emergency patch being released, which was made available on February 7.

The attacks have prompted the Health Sector Cybersecurity Coordination Center (HC3) to issue a further warning about the Clop ransomware group, which claimed responsibility for the attacks. According to Clop, the attacks occurred over a period of around 10 days. The group claims to have exploited the vulnerability – a pre-authentication remote code execution vulnerability in the License Response Servlet – allowing the theft of sensitive data. Clop typically uses ransomware to encrypt files after exfiltrating sensitive data, then issues a ransom demand and a threat to publicly release data if payment is not made. In these attacks, the group said it could have deployed ransomware but chose not to do so, instead opting for an extortion-only approach.

Clop is a Russia-linked ransomware group that has been active since at least February 2019, when the first observed attack was conducted by a threat group tracked as TA505 – the group behind the infamous Dridex banking Trojan. Clop (or Cl0p) is the name of the ransomware variant deployed in attacks, which have largely been conducted on organizations in the HPH sector and other critical infrastructure operators. A law enforcement operation against Clop saw 6 individuals arrested in Ukraine in June 2021; however, the group has continued to operate, apparently unaffected by those arrests and continues to pose a major threat to the healthcare and public health (HPH) sector.

HC3 first issued a warning about the Clop ransomware group in March 2021, and in January this year issued an updated Analyst Note following continued attacks on the HPH sector. While details of some of the tactics, techniques, and procedures used by the Clop ransomware gang have been shared by HC3, the Clop group continues to evolve its tactics as the latest string of attacks has clearly demonstrated.

Defending against cyberattacks by a highly capable threat group that constantly changes tactics can be a challenge; however, HC3 recommends following the advice of many cybersecurity professionals by “prioritizing security by maintaining awareness of the threat landscape, assessing their situation, and providing staff with tools and resources necessary to prevent a cyberattack remains the best way forward for healthcare organizations.”

The latest HC3 alert can be found here.

The post HC3 Issues HPH Sector Alert Following Suspected Clop Cyberattacks appeared first on HIPAA Journal.

Security researchers have issued warnings following an increase in cyberattacks distributing a malware variant called GootLoader. GootLoader is a malware loader first identified in 2014 that is now one of the biggest malware threats. The threat group behind the campaign is highly capable and has been evolving its tactics and actively developing the malware to better evade security defenses.

The delivery of GootLoader is the first stage of an attack chain that will see multiple malicious payloads delivered, such as Cobalt Strike Beacon, FoneLaunch, and SnowCone. FoneLaunch is a .NET loader that loads encoded payloads in the memory and SnowCone is a downloader that retrieves and executes payloads that are used in the next stage of the attack, including the IcedID banking Trojan and malware dropper.

According to security researchers at Mandiant, GootLoader appears to be exclusively used by a threat actor it tracks as UNC2565. In 2022, UNC2565 adopted notable new tactics, techniques, and procedures (TTPs) and is actively evolving its TTPs to improve the effectiveness of its campaigns, including adding new components and obfuscations to the infection chain. GootLoader is primarily spread through compromised websites. Traffic is sent to those websites using SEO poisoning, which involves creating web content using search engine optimization tactics to get the sites to appear high in the search engine listings for specific business-related search terms. These can include business-related documents such as contract templates and service-level agreements. When a user arrives on the site they are tricked into downloading a malicious file, which is typically a ZIP archive that includes an obfuscated JavaScript file that masquerades as the document being searched for. If that file is executed, the infection chain is initiated leading to GootLoader being installed and other malicious payloads being delivered and executed.

Mandiant says UNC2565 changed the attack sequence in November 2022 and modified the .js file in the ZIP file to deliver a new variant dubbed GootLoader.PowerShell, which writes a second JavaScript file to the system disk that reaches out to 10 hard-coded URLs and exfiltrates system information. The new variant was used in a wave of attacks on the healthcare sector in Australia in late 2022.

Security researchers at Cybereason have also issued a warning about UNC2565 following an increase in attacks in the United States, United Kingdom, and Australia. In addition to SEO poisoning, Cybereason researchers say the group has started using Google Ads to drive traffic to their malicious websites and is now using Cobalt Strike and SystemBC for data exfiltration. New tactics identified include multiple JavaScript loops that delay the execution process, which they believe have been adopted to evade sandbox mechanisms. They also report that after GootLoader is executed, the threat actors move quickly and manually deploy attack frameworks, elevate privileges, and move laterally within compromised networks. That process typically takes less than 4 hours. While multiple sectors have been targeted, attacks have primarily been focused on organizations in the finance and healthcare sectors, with Cybereason’s researchers considering the threat level to be severe.

Researchers at both companies say UNC2565 is actively developing its TTPs and increasing its capabilities, and organizations in the healthcare sector should be on high alert. Network defenders can obtain further information on the TTPs, Indicators of Compromise (IoCs), and recommended mitigations in the GootLoader reports from Mandiant and Cybereason.

The post Healthcare Sector Warned About Increase in GootLoader Malware Infections appeared first on HIPAA Journal.

The Health Sector Cybersecurity Coordination Center (HC3) at the Department of Health and Human Services has issued a DDoS guide for the healthcare sector that includes information on the threat and recommended mitigations to limit the severity and impact of DDoS attacks.

Distributed-Denial-of-Service (DDoS) attacks are a type of resource exhaustion flooding attack that involves consuming the resources of a server, service, or network to prevent legitimate use. These attacks typically involve the use of botnets of compromised computers and IoT devices, which flood the targeted IP address with traffic to cause the server, service, or network to become overwhelmed. These attacks can result in a denial-of-service to normal traffic due to the log jam the huge volume of malicious traffic creates. These attacks typically cause disruption for several hours, although attacks can continue for several days.

These attacks usually only cause temporary disruption to services and do not, by themselves, typically involve data theft or cause hardware damage. Attacks may, however, be conducted as a smokescreen to distract security teams. While the security team is dealing with the DDoS attack, the threat actor attempts a simultaneous attack – for example, port scanning, malware delivery, a phishing attack, or data exfiltration.

DDoS attacks may also be conducted as part of an extortion attack, where a ransom demand is issued and payment is required to stop the attack. HC3 says these ransom DDoS attacks are becoming more common and have increased by 24% quarter-over-quarter and 67% year-over-year. These ransom DDoS attacks are typically conducted on web applications, such as patient portals, webmail, patient monitoring applications, and telehealth services.

The healthcare and public health (HPH) sector is currently being targeted by a pro-Russian hacktivist group called Killnet. Killnet has been conducting DDoS attacks in countries that are providing support to Ukraine, with a particular focus on hospitals and medical organizations. While the group has threatened to steal and publicly release sensitive patient data, these claims may simply be attention-seeking behavior. The DDoS attacks conducted by the group in recent weeks do not appear to have involved any other malicious activity other than causing a denial-of-service on websites and web applications.

While it is difficult to prevent targeted DDoS attacks, several steps can be taken to limit the severity and impact of DDoS attacks. Since these attacks typically target websites and web applications, security controls should be implemented to protect these assets. “Healthcare organizations should sanitize, increase resource availability, implement cross-site scripting (XSS) and cross-site request forgery (XSRF) protections, implement Content Security Policy (CSP), and audit third party code,” suggest HC3. “Additional steps include running static and dynamic security scans against the website code and system, deploying web application firewalls, leveraging content delivery networks to protect against malicious web traffic, and providing load balancing and resilience against high amounts of traffic.” Since threat actors typically use User Data Protocol (UDP), SYN (synchronize), and Transmission Control Protocol (TCP) to perpetuate DDoS attacks, these should also be a focus for network defenders.

The alert includes several other recommendations for preventing attacks, assessing and mitigating attacks in progress, and improving defenses and incident response processes to limit the harm caused by future attacks.

The post HC3 Issues DDoS Guide for the Healthcare Sector appeared first on HIPAA Journal.

The threat intelligence provider, Mandiant, says almost all cybersecurity leaders are happy with the threat intelligence they are consuming, but that intelligence is not always considered when they develop their cyber strategies and make purchasing decisions. The failure to effectively use threat intelligence data prevents organizations from getting the maximum ROI on their investment and reduces the effectiveness of their cybersecurity strategies.

Mandiant commissioned a survey of 1,350 cybersecurity decision-makers at organizations with at least 1,000 employees, across 18 sectors in 13 countries to gain a global perspective on how organizations are leveraging threat intelligence to navigate the global cybersecurity threat landscape. The survey confirmed that organizations typically receive threat intelligence from multiple sources, and 96% of cybersecurity leaders say they are happy with the threat intelligence they were receiving; however, 47% of respondents said they struggle to effectively apply threat intelligence throughout their organization and almost all respondents (98%) said they need to be faster at implementing changes based on the threat intelligence they receive.

A majority of respondents (79%) admitted to making purchasing decisions based on current cyberattack trends, without gaining insights into the attackers that are actually targeting their industry and the tactics they are using. For instance, security teams often implement defenses against advanced persistent threat actors (APT), when these nation-state actors do not actually pose a threat to their organization or sector. Security teams receive huge numbers of alerts about software vulnerabilities yet fail to use threat intelligence to identify which vulnerabilities are actually being exploited by the threat actors targeting their sector, or if the threat actors would even be able to exploit the vulnerabilities. While more than 85% of security leaders appreciate the importance of identifying attackers, their tools and techniques, and motivations, only 34% said they consider the source of a potential attack when they test their cybersecurity defenses.

If threat intelligence is not factored into purchasing decisions, solutions may be purchased that fail to provide the optimum level of protection against the most pertinent threats to their sector, which could weaken their cybersecurity strategy. Organizations that factor threat intelligence into purchasing decisions and cybersecurity strategies can achieve optimal protection against the tactics, techniques, and procedures used by the threat actors that are actually targeting their organization.

Even though security decisions are made without insights into the threat actors that are attacking them, security decision-makers were still confident in their cybersecurity defenses, especially against financially motivated threats such as ransomware. 91% of respondents were confident about their ability to protect against ransomware attacks, 89% were confident about defending against attacks by hacktivists, 83% were confident about defending against nation-state threat actors, and almost all respondents (95%) were confident they could prove to their senior leadership that they had a moderate to highly effective cybersecurity strategy.

More than two-thirds of cybersecurity decision-makers said they believe their senior leadership teams underestimate the cyber threat posed to their organization and 68% said their organization needs to improve its understanding of the threat landscape. While security teams understand the importance of threat intelligence, 79% of respondents admitted that they could focus more time and energy on identifying critical trends. The survey also revealed threat intelligence is not shared frequently enough throughout the organization. For example, Cybersecurity is only discussed on average once every four or five weeks with various departments within organizations, and only 38% of security teams share threat intelligence with a wider group of employees for risk awareness.

“A conventional, check-the-box mindset isn’t enough to defend against today’s well-resourced and dynamic adversaries. Security teams are outwardly confident, but often struggle to keep pace with the rapidly changing threat landscape. They crave actionable information that can be applied throughout their organization,” said Sandra Joyce, Vice President, Mandiant Intelligence at Google Cloud. “As our ‘Global Perspectives on Threat Intelligence’ report demonstrates, security teams are concerned that senior leaders don’t fully grasp the nature of the threat. This means that critical cyber security decisions are being made without insights into the adversary and their tactics.”

One of the problems highlighted by the survey is information overload. Organizations receive vast amounts of threat data that needs to be processed and there is concern that important information may be missed. 84% said they were concerned that they may be missing vital threat intelligence due to the number of alerts and data they have to process, and 69% of respondents said they feel overwhelmed by the threat intelligence data they receive. In healthcare, 79% of respondents said they feel somewhat or completely overwhelmed by the amount of data and alerts they have to deal with.

Mandiant offers several suggestions that can help security leaders maximize their investment and effectively operationalize their cyber threat intelligence. Organizations should regularly evaluate the data received to make sure it is timely, trustworthy, and accurate. It is important to learn about the threat actors that are actually targeting the organization and sector, adapt defenses accordingly, then test defenses and the organization’s response to the attack tactics that have been identified and track improvements over time. Threat intelligence also needs to be leveraged across all security systems and processes to proactively protect against all potential threats. Organizations should also ensure that threat intelligence is communicated effectively with stakeholders to allow that intelligence to be factored in when making purchasing decisions.

The post Mandiant: Organizations Are Not Getting the Maximum ROI from Threat Intelligence appeared first on HIPAA Journal.