Healthcare Cybersecurity

Study Suggests Businesses Are Not Prepared for the Escalation in Cyberattacks

Posted by HIPAA Journal

Businesses are appreciating the importance of cybersecurity and realizing that they need to invest more heavily in cybersecurity as threats are evolving at such a rapid pace. The challenge for businesses is ensuring that their defenses allow them to stay one step ahead of cybercriminals, but the frequency at which data breaches are being reported suggests many businesses are struggling to keep up the pace.

In order to understand how to keep their businesses secure, IT leaders need to know how cybercriminals are bypassing defenses. They can then make informed decisions about the security solutions they need to invest in that will give them the best ROI in terms of security.

Keeper Security recently conducted a survey to explore how cybersecurity is transforming and where businesses are investing in cybersecurity tools. The survey was conducted on 516 IT decision-makers in the United States and the findings were published in Keeper’s 2022 U.S. Cybersecurity Census Report. The report delves into the threats that businesses face and the strategies that can be adopted by businesses to better deal with cyber threats and stay one step ahead of the threat actors that are trying to breach their networks.

Businesses realize that cybersecurity is a key priority. 71% of businesses said they have made new hires in cybersecurity in the past 12 months, but even with additional skilled staff, there is concern among businesses that they will not be able to maintain pace with the fast-evolving cyber threat landscape.

According to the study, U.S. business experiences an average of 42 cyberattacks a year and IT leaders predict that attacks will increase in the next 12 months. A majority of respondents said they were confident in their ability to defend against cyber threats and that they believe they have the cybersecurity solutions and tools in place to protect against attacks, even though an overwhelming majority of surveyed organizations experienced a successful cyberattack in the past year. IT leaders also report that it is now taking longer to identify and respond to cyberattacks.

The survey confirmed the impact cyberattacks are having on businesses. 31% of businesses said they had experienced a successful cyberattack that had disrupted partner/customer operations, with the same percentage saying attacks resulted in the theft of financial information. 28% said attacks caused reputational damage, with the same percentage saying corporate information was stolen. Almost a quarter said attacks resulted in disruption of the supply chain and trading/business operations. These attacks are having a considerable financial impact on businesses. On average, successful attacks cost businesses $75,000 per incident, with almost 4 in 10 organizations saying attacks have cost more than $100,000 to resolve.

While there was a high degree of confidence in cybersecurity defenses, the survey revealed the technology being used to defend against attacks was missing essential tools. Almost one-third of businesses did not have a management platform for IT secrets, such as API keys, database passwords, and privileged credentials. 84% of respondents were concerned about hard-coded credentials in source code, yet 25% of businesses did not have any software in place to remove them.

58% of Americans now spend at least some of the week working remotely, yet more than a quarter of businesses said they do not have a remote connection management solution in place to allow their IT infrastructure to be accessed securely by remote workers.

Identity and access management vulnerabilities were also identified. Only 44% of businesses said they provide their employees with best practices governing passwords and access management, and three out of 10 businesses let their employees set and manage their own passwords and admitted employees frequently share access to passwords. Only 26% of businesses said they have a highly sophisticated framework in place for visibility and control of identity security.

“This laissez-faire approach to access management makes it clear that more must be done to keep organizations and their employees protected,” explained Keeper Security in the report. “Despite these issues presenting a clear threat to businesses, fewer than half of respondents state they have plans to invest in password management, visibility tools for network-based threats, or infrastructure secrets management.”

The main areas where businesses plan to invest in security in the next 12 months are security awareness training (54%), creating a culture of compliance (50%), password management (48%), improving visibility to detect network threats (44%), infrastructure secrets management (42%), and passwordless authentication (42%). Despite its importance, only 32% of businesses said they are planning to adopt a zero-trust and zero-knowledge approach to security.

While it is encouraging to see many businesses making cybersecurity a key priority, the survey revealed a lack of transparency about cyberattacks at many businesses. 48% of IT leaders said they were aware of a cyberattack and kept it to themselves. “For U.S. businesses to become truly secure, perhaps the biggest change that must be made is cultural,” explained Keeper Security in the report. “Nearly half of IT leaders admitted to keeping a cyberattack they were aware of to themselves (suggesting they did not report it to any relevant authority). This figure should shock business leaders. Without a culture of trust, accountability, and responsiveness, cybercriminals will thrive.”

The post Study Suggests Businesses Are Not Prepared for the Escalation in Cyberattacks appeared first on HIPAA Journal.

25% of Healthcare Organizations Said a Ransomware Attack Forced Them to Completely Halt Operations

Posted by HIPAA Journal

Ransomware attacks continue to plague the healthcare industry. The attacks disrupt operations due to essential IT systems being taken offline, the lack of access to electronic health records causes patient safety issues, and it is common for emergency patients to be redirected to other facilities immediately after attacks and for appointments to be postponed.

Recently, cybersecurity firm Trend Micro conducted a study to investigate the impact ransomware attacks are having on healthcare organizations. The survey was conducted on 145 business and IT decision-makers in the sector, with a more extensive global study on the ransomware threat conducted by Sapio Research on 2,958 IT security decision-makers in 26 countries.

Trend Micro reports that 25% of all data breaches now involve ransomware. Between 2017 and 2021, ransomware attacks increased by 109%, and 2022 has seen a 13%  year-over-year increase in attacks. These attacks are having a major impact on healthcare organizations, which have been actively targeted by several ransomware gangs.

57% of healthcare organizations said they had experienced a ransomware attack at some point in the past 3 years. 86% of healthcare organizations that suffered a ransomware attack suffered operational outages as a direct result of the attack, with 25% of organizations that experienced an attack forced to completely halt operations. 60% said that some business processes were disrupted due to the attack.

The recovery time from these attacks can be considerable, with healthcare organizations continuing to face disruption to their services for extended periods. 56% of organizations represented in the survey said it took several days to recover from the attack, with almost a quarter (24%) saying it took weeks to fully restore operations after an attack.

Data theft is now common in ransomware attacks, with threats issued to publish or sell the stolen data if the ransom is paid. This tactic has proven so successful that some cybercriminal groups have abandoned ransomware altogether and now just steal data and threaten to publish if payment is not made. 60% of responding organizations said sensitive data was stolen and leaked by the attackers, with the data theft and leakage leading to reputational damage, compliance risks, and increasing the investigation, remediation, and clean-up costs.

The research indicates healthcare organizations have been taking proactive steps to counter the threat and improve their defenses. 95% of responding organizations said they are patching promptly to address software vulnerabilities, 91% have implemented additional controls to prevent malicious email attachments from being delivered, and adoption of advanced detection and response tools for their network (NDR) and endpoints (EDR) is growing, as is the use of extended detection and response (XDR) solutions.

There is also considerable concern about supply chains. 43% of respondents said their partners have made them more attractive targets for attacks, 43% said they lack visibility across the ransomware attack chain which is making them more vulnerable, and 36% said the lack of visibility across attack surfaces which has made them a bigger target.

However, the survey revealed several security gaps. For instance, 17% of respondents did not have any remote desktop controls in place, despite RDP vulnerabilities commonly being exploited to gain initial access to healthcare networks. There is considerable room for improvement concerning threat intelligence sharing, with 30% admitting to not sharing threat intelligence with partners, 46% do not share threat information with suppliers or the broader ecosystem, and one-third (33%) said they do not share any information with law enforcement.

Only 51% of organizations use NDR, 50% use EDR, and 43% use XDR, with only 46% of organizations monitoring for living-of-the-land techniques such as the malicious use of tools such as MimiKatz and PsExec. Only 42% say they can detect initial access and just 32% can detect lateral movement.

“In cybersecurity, we often talk in abstractions about data breaches and network compromise. But in the healthcare sector, ransomware can have a potentially very real and very dangerous physical impact,” said Bharat Mistry, Technical Director at Trend Micro. “Operational outages put patient lives at risk. We can’t rely on the bad guys to change their ways, so healthcare organizations need to get better at detection and response and share the appropriate intelligence with partners to secure their supply chains.”

The post 25% of Healthcare Organizations Said a Ransomware Attack Forced Them to Completely Halt Operations appeared first on HIPAA Journal.

HHS Warns HPH Sector About Abuse of Legitimate Software and Security Tools by Threat Actors

Posted by HIPAA Journal

It has become increasingly common for threat actors to use living-off-the-land techniques for conducting reconnaissance, privilege escalation, persistence, and moving laterally within networks undetected. The same software and security tools used by network administrators and red team professionals for legitimate purposes are abused and used to conduct attacks on victims’ infrastructure.

Threat actors leverage software tools that have already been installed to avoid having to download files via the Internet, malicious activities can be hidden within the logs along site legitimate use of these tools, and these tools are used to conduct malicious activities in the memory to evade security solutions. Traditional approaches to security such as blocking hashes of malicious files and malicious domains are ineffective against these tools, as they are already installed on the network.

Recently, the Health Sector Cybersecurity Coordination Center (HC3) issued a white paper warning the healthcare and public health sector (HPH) about these living-off-the-land techniques to raise awareness of the threat and explain the risks of using certain tools. The tools most commonly abused by malicious actors include the penetration testing and adversary simulation frameworks Cobalt Strike and Brute Ratel; Microsoft’s cross-platform automation tool, PowerShell; the credential dumping application, Mimikatz; the Windows troubleshooting application, Sysinternals; and the remote desktop application, Anydesk.

These and other tools have been extensively used by nation-state hackers and cybercriminals in attacks on a wide range of sectors, including healthcare, and mitigating against these tools can be a significant challenge. These tools all have legitimate uses and are often deployed on common systems, but the malicious use of these tools can be difficult to detect.

Cobalt Strike, for instance, has been extensively abused by threat actors for the past 5 years. More than 8,000 attacks have been conducted that leveraged this comprehensive red team framework. The tool is commonly used by penetration testers to assess risks and vulnerabilities and simulate attacks, but the extensive capabilities of the framework are ripe for abuse. Cobalt Strike can be used as a highly customizable spear phishing tool, for discovering client-side applications, conducting exploitation/post-exploitation activities, data transfers, real-time communications, and for command and control of compromised systems. Brute Ratel is a newer and less well-known framework that has many of the same capabilities. Both of these tools are extensively used by ransomware gangs and nation-state threat actors, including in attacks on the healthcare sector.

PowerShell is a command shell and scripting language that is extensively used by IT teams for automation and configuration management, and defending against misuse can be a particular challenge. It is often not possible to block the use of the tool due to the value it provides, but if the tool is not commonly used, it should be disabled through group or security policies.

AnyDesk is a remote access solution that is used to access several operating systems for providing remote IT support. AnyDesk is also commonly used for file transfers and virtual private network services. Connections are encrypted to protect against data interception, but that also makes it harder to detect malicious use. AnyDesk has been extensively used by ransomware actors, including AvosLocker and Babuk, and BazarLoader uses AnyDesk to deploy ransomware payloads.

HC3 says the Department of Health and Human Services neither endorses nor condemns the use of these tools but recommends entities in the HPH sector should carefully evaluate these tools and assess the risks and rewards, and determine whether the value provided outweighs the risks.

In the white paper, HC3 provides a detailed explanation of each of these tools, their legitimate uses, how they are abused by threat actors, and steps that can be taken to prevent and detect malicious use.

The post HHS Warns HPH Sector About Abuse of Legitimate Software and Security Tools by Threat Actors appeared first on HIPAA Journal.

HHS Warns HPH Sector About Abuse of Legitimate Software and Security Tools by Threat Actors

Posted by HIPAA Journal

It has become increasingly common for threat actors to use living-off-the-land techniques for conducting reconnaissance, privilege escalation, persistence, and moving laterally within networks undetected. The same software and security tools used by network administrators and red team professionals for legitimate purposes are abused and used to conduct attacks on victims’ infrastructure.

Threat actors leverage software tools that have already been installed to avoid having to download files via the Internet, malicious activities can be hidden within the logs along site legitimate use of these tools, and these tools are used to conduct malicious activities in the memory to evade security solutions. Traditional approaches to security such as blocking hashes of malicious files and malicious domains are ineffective against these tools, as they are already installed on the network.

Recently, the Health Sector Cybersecurity Coordination Center (HC3) issued a white paper warning the healthcare and public health sector (HPH) about these living-off-the-land techniques to raise awareness of the threat and explain the risks of using certain tools. The tools most commonly abused by malicious actors include the penetration testing and adversary simulation frameworks Cobalt Strike and Brute Ratel; Microsoft’s cross-platform automation tool, PowerShell; the credential dumping application, Mimikatz; the Windows troubleshooting application, Sysinternals; and the remote desktop application, Anydesk.

These and other tools have been extensively used by nation-state hackers and cybercriminals in attacks on a wide range of sectors, including healthcare, and mitigating against these tools can be a significant challenge. These tools all have legitimate uses and are often deployed on common systems, but the malicious use of these tools can be difficult to detect.

Cobalt Strike, for instance, has been extensively abused by threat actors for the past 5 years. More than 8,000 attacks have been conducted that leveraged this comprehensive red team framework. The tool is commonly used by penetration testers to assess risks and vulnerabilities and simulate attacks, but the extensive capabilities of the framework are ripe for abuse. Cobalt Strike can be used as a highly customizable spear phishing tool, for discovering client-side applications, conducting exploitation/post-exploitation activities, data transfers, real-time communications, and for command and control of compromised systems. Brute Ratel is a newer and less well-known framework that has many of the same capabilities. Both of these tools are extensively used by ransomware gangs and nation-state threat actors, including in attacks on the healthcare sector.

PowerShell is a command shell and scripting language that is extensively used by IT teams for automation and configuration management, and defending against misuse can be a particular challenge. It is often not possible to block the use of the tool due to the value it provides, but if the tool is not commonly used, it should be disabled through group or security policies.

AnyDesk is a remote access solution that is used to access several operating systems for providing remote IT support. AnyDesk is also commonly used for file transfers and virtual private network services. Connections are encrypted to protect against data interception, but that also makes it harder to detect malicious use. AnyDesk has been extensively used by ransomware actors, including AvosLocker and Babuk, and BazarLoader uses AnyDesk to deploy ransomware payloads.

HC3 says the Department of Health and Human Services neither endorses nor condemns the use of these tools but recommends entities in the HPH sector should carefully evaluate these tools and assess the risks and rewards, and determine whether the value provided outweighs the risks.

In the white paper, HC3 provides a detailed explanation of each of these tools, their legitimate uses, how they are abused by threat actors, and steps that can be taken to prevent and detect malicious use.

The post HHS Warns HPH Sector About Abuse of Legitimate Software and Security Tools by Threat Actors appeared first on HIPAA Journal.

Advisory Issued About BD Totalys MultiProcessor Vulnerability

Posted by HIPAA Journal

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a medical advisory about a recently discovered vulnerability that affects the BD Totalys MultiProcessor, which is used by hospitals and labs for processing clinical tissue specimens.

The vulnerability is due to the use of hard-coded credentials, which could allow an attacker with access to a vulnerable Totalys MultiProcessor to access, modify, or delete sensitive data, including personally identifiable and protected health information.

The vulnerability cannot be exploited remotely. In order to exploit the flaw, a malicious actor would need physical access to the BD Totalys MultiProcessor or network access to the system. Any additional security controls would also need to be bypassed.

The vulnerability, tracked as CVE-2022-40263, affects all BD Totalys MultiProcessor versions including and prior to v1.70, and has been assigned a CVSS severity score of 6.6 out of 10 (medium severity).

The vulnerability was discovered by BD and was reported to CISA under its responsible disclosure policy. BD says the vulnerability is due to be remediated in the upcoming v1.71 software release, which is expected to be made available to users in Q4, 2022. In the meantime, BD has suggested mitigations to prevent exploitation of the vulnerability.

Users should ensure physical access controls are in place to ensure access to the BD Totalys MultiProcessor is restricted to authorized individuals. If the device must be networked, industry standard security policies and procedures should be followed.

At the time of issuing the alert, there have been no cases of exploitation of the flaw and there are no known exploits in the public domain.

The post Advisory Issued About BD Totalys MultiProcessor Vulnerability appeared first on HIPAA Journal.

Cybersecurity Awareness Month Focuses on 4 Key Behaviors

Posted by HIPAA Journal

October is Cybersecurity Awareness Month – a 19-year collaborative effort between the government and industry to improve awareness of cybersecurity in the United States, led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA).

2022 Cybersecurity Awareness Month – See Yourself in Cyber

The theme of this year’s Cybersecurity Awareness Month is See Yourself in Cyber, where the focus is on the actions that everyone should take to improve cybersecurity. In previous years, the month of October has been divided into four weeks, each of which has a different theme. This year, rather than have a different weekly theme, the focus each week will be on one of four key behaviors that everyone should adopt. Simply practicing these basics of cybersecurity will greatly improve an individual’s and an organization’s security posture.

  1. Enabling multifactor authentication – Improve access controls by adding additional authentication requirements in addition to a password. MFA can prevent access from being granted to accounts using stolen credentials.
  2. Using strong passwords and a password manager – Set strong, unique passwords for all accounts that are resilient to brute force attacks and use a password manager to create those passwords and store them securely in an encrypted password vault.
  3. Updating software – Ensure software is kept up to date and apply patches promptly to correct known vulnerabilities.
  4. Recognizing and reporting phishing – Learn about the signs of phishing, the red flags in emails, text messages, social media posts, and telephone calls that can indicate a phishing attempt, and ensure phishing attempts are reported.

“To build a more resilient nation, everyone—from K through Gray—has a role to play, which is why our theme for this year’s Cybersecurity Awareness Month is ‘See Yourself in Cyber,'” said CISA Director Jen Easterly. “This October, we are taking this message directly to the American people because whether you’re a network defender or anyone with an internet connection, we all have a role to play in strengthening the cybersecurity of our nation.”

Improving Cybersecurity Awareness in Healthcare

Many cyberattacks succeed due to mistakes by employees and a lack of awareness of basic aspects of cybersecurity. According to the 2022 Verizon Data Breach Investigations Report, 82% of data breaches in 2021 involved the human element. Improving security awareness of the workforce by focusing on the above key behaviors will go a long way toward improving security and preventing data breaches.

Security awareness training is a requirement for compliance with the HIPAA Security Rule. The administrative safeguards of the HIPAA Security Rule require all HIPAA-regulated entities to train all workforce members on internal security policies and procedures, with the 45 CFR § 164.308 (a)(5)(i) standard requiring “a security awareness and training program for all members of its workforce (including management).”

HIPAA-regulated entities should adopt a risk-based approach when developing training courses and should teach cybersecurity basics and focus on the most important behaviors that can reduce risk. The HHS’ Office for Civil Rights has issued guidance on aspects of cybersecurity to include in security awareness training programs and raises awareness of important themes in its quarterly cybersecurity newsletters.

“The Security Rule requires regulated entities to implement a security awareness and training program for all workforce members,” explained OCR in its Q1, 2022 cybersecurity newsletter. “A regulated entity’s training program should be an ongoing, evolving process and be flexible enough to educate workforce members on new and current cybersecurity threats (e.g., ransomware, phishing) and how to respond.” OCR also stressed the need for training to be provided to all members of the workforce, which includes management personnel and senior executives.

Training should be followed up with regular security reminders, which are an addressable specification of the HIPAA Security Rule. Cybersecurity Awareness Month is the ideal time to focus on security reminders and develop a program for delivering these reminders regularly. OCR suggests security reminders can include cybersecurity newsletters, but also phishing simulations to members of the workforce to gauge the effectiveness of the security awareness and training program, and to provide additional, targeted training to employees who are fooled by the simulations. HIPAA-regulated entities should consider implementing a mechanism that allows employees to easily report phishing attempts and suspicious emails to their security teams, such as an email client add-on that allows one-click reporting, and to encourage employees this month to report potential threats.

Multifactor authentication is an effective additional safeguard for improving access controls to prevent stolen credentials from being used to access accounts. This month is the ideal time to accelerate plans to implement multifactor authentication – if MFA has not already been implemented – and to ensure that it is applied to all accounts. Phishing campaigns are being conducted that allow certain types of multifactor authentication to be bypassed. To protect against these MFA bypass attacks, MFA implementation can be made more resilient by using a solution that supports Fast ID (FIDO) v2.0 and certificate-based authentication.

Brute force attacks often succeed due to employees setting weak passwords or reusing passwords on multiple accounts. HIPAA-regulated entities should enforce their password policies, but also make compliance with those policies easier for employees by supplying a business password manager. Password managers can suggest truly random, complex passwords, and greatly improve password security and management.

It is easy to focus on technical defenses for protecting ePHI and preventing unauthorized access, but the importance of training cannot be overstated. Ensuring all employees are aware of the above key behaviors and are practicing good cyber hygiene will go a long way toward improving the cybersecurity posture of the entire organization.

The post Cybersecurity Awareness Month Focuses on 4 Key Behaviors appeared first on HIPAA Journal.

Zero Day Microsoft Exchange Server Vulnerabilities Being Actively Exploited

Posted by HIPAA Journal

Microsoft was warned that two zero-day vulnerabilities in Microsoft Exchange Server are being actively exploited in the wild and has shared mitigations ahead of the vulnerabilities being patched.

The two flaws are being chained together and are being exploited by a Chinese threat actor. The attacks have been limited so far, but the healthcare and public health sector in the United States could potentially be a target.

The flaws affect Microsoft Exchange Server 2013, 2016, and 2019. CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability that can be exploited for initial access, after which the second vulnerability can be exploited – A Remote Code Execution vulnerability thacked as CVE-2022-41082. The second vulnerability can only be exploited if PowerShell is available to the attacker.

Microsoft has confirmed that the flaws cannot be exploited by an unauthenticated attacker. Both vulnerabilities require authenticated access to a vulnerable Microsoft Exchange Server to be exploited, such as if an attacker had valid stolen credentials. The first vulnerability has been assigned a CVSS severity score of 8.8 out of 10 and the second vulnerability has a CVSS score of 6.3. If the flaws are exploited, a threat actor could deploy a backdoor for persistent access. The attackers have deployed the China Chopper web shell for persistent access in some of the attacks, which suggests the flaws are being exploited by a state-sponsored Chinese hacking group.

Microsoft is it is working on patches for the flaws on an accelerated timeline and has shared mitigations that can be implemented by users of on-premises Microsoft Exchange Servers ahead of the patches being released. Microsoft said it has implemented detection rules for Microsoft Exchange Online and has mitigations in place to protect customers, so Exchange Online customers do not need to take any actions to prevent exploitation of the flaws.

Customers with on-premises Microsoft Exchange Servers can add a blocking rule to ‘IIS Manager -> Default Web Site -> URL Rewrite -> Actions’ which will block the known attack patterns, the details of which have been detailed in the Microsoft Security Response Center blog.

The post Zero Day Microsoft Exchange Server Vulnerabilities Being Actively Exploited appeared first on HIPAA Journal.

Medical Device Cybersecurity Requirements Stripped from FDA Reauthorization Bill

Posted by HIPAA Journal

The U.S Food and Drug Administration (FDA) user fee reauthorization bill passed by the House of Representatives in June included new provisions requiring medical device manufacturers to monitor for and address postmarket cybersecurity vulnerabilities in their devices, ensure medical devices are labeled with a software bill of materials and are capable of receiving patches to ensure cybersecurity for the entire lifecycle of the devices. The bill was passed with a vote of 392-28; however, those cybersecurity requirements have now been stripped out.

The FDA’s authorization to collect fees from the healthcare sector to conduct independent reviews of drugs and medical devices was due to come to an end on September 30, and with time running out, the FDA bowed to pressure from Senate republicans and stripped out the new cybersecurity requirements for medical device manufacturers. Were the FDA’s 5-year authorization not to be renewed, the FDA anticipated only being able to continue with its review activities for around 5 weeks before its money ran out. The FDA reauthorization was included in a temporary spending bill that has now been passed and will keep the FDA and the rest of the Federal government funded through December 16, 2022.

“In June, the House passed a user fee reauthorization package on time with overwhelming bipartisan support. After the House passed its user fee package, bipartisan Energy and Commerce and HELP leaders came to agreement on language to cover many significant policy areas that we wanted included in the Continuing Resolution,” said Energy and Commerce Committee Chairman Frank Pallone, Jr. (D-NJ) in a statement. “Unfortunately, Senate Republican leadership blocked these policy agreements from being included.”

U.S. Senators Patty Murray (D-WA) and Richard Burr (R-NC), Chair and Ranking Member of the Senate Committee on Health, Education, Labor, and Pensions (HELP), issued a statement on the FDA reauthorization. “We are glad to announce an agreement to reauthorize the FDA user fee programs, which will ensure that FDA can continue its important work and will not need to send out pink slips. However, there is more work ahead this Congress to deliver the kinds of reforms families need to see from FDA, from industry, and from our mental health and pandemic preparedness efforts.” The senators confirmed that they are committed to continuing that work, and will be including strong, bipartisan legislation in a robust end-of-year package.

The removal of the cybersecurity requirements is a disappointment but not surprising. Healthcare organizations should not wait for regulatory changes and should ensure that they proactively identify and address vulnerabilities in medical devices to ensure the security of their networks, confidentiality of data, and patient safety.

The post Medical Device Cybersecurity Requirements Stripped from FDA Reauthorization Bill appeared first on HIPAA Journal.

Healthcare Industry Warned About Risk Posed by APT41 Threat Group

Posted by HIPAA Journal

The Health Sector Cybersecurity Coordination Center (HC3) has issued a warning about the Chinese state-sponsored threat actor tracked as APT41. The group has been active since at least 2012 and has a history of targeting the healthcare sector, as well as education, high-tech, media, retail, software, pharma, telecoms, video games, travel services, and virtual currencies, with companies in the United States frequently targeted.

The group is known to conduct spear phishing, watering hole, and supply chain attacks, and frequently deploys backdoors to give persistent access to victims’ networks. Recently the threat group has been observed using SQL injection for the initial attack and Cobalt strike beacons, which are uploaded in small chunks. The group gains access to networks and gathers intelligence that can be used in future attacks and steals industry-specific information.

Once initial access is gained, the group escalates privileges, performs internal reconnaissance using compromised credentials, moves laterally within networks using Remote Desktop Protocol (RDP), stolen credentials, adds admin groups, and brute forces utilities. The group uses public and private malware and maintains persistence through backdoors. The group is known to use the BLACK COFFEE reverse shell, China Chopper web shell, Cobalt Strike, Gh0st Rat and PlugX remote access tools, Mimikatz for credential theft, and the ShadowPad backdoor. Data of interest are added to a RAR file for exfiltration, and the group covers its tracks by deleting evidence of compromise.

APT41 – also known as Double Dragon, Barium, Winnti, Wicked Panda, Wicked Spider, TG-2633, Bronze Atlas, Red Kelpie – conducted targeted campaigns on the healthcare sector in 2014, 2015, 2016, 2018, 2019, and 2020. Initially, the group was interested in IT and medical device software companies but has also targeted biotech firms and US cancer research facilities. In the attacks on cancer research facilities, the group exploited the CVE-2019-3396 vulnerability in Atlassian Confluence Server to gain access to networks and deployed EVILNUGGET malware.

In one of the more recent campaigns targeting healthcare organizations between January 2020 and March 2020, the group targeted Citrix, Cisco, and Zoho endpoints, exploiting the CVE-2019-19781 Citrix directory traversal vulnerability, and the CVE-2020-10189 Zoho remote code execution vulnerability. At least 75 organizations were targeted in the campaign.

In 2021 and 2022, the group conducted two zero-day attacks on the Animal Health Reporting Diagnostic System (USAHERDS) web-based application and successfully compromised at least six US state governments. The attacks are thought to have involved exploitation of the Log4j remote code execution vulnerability (CVE-2022-44228) and the zero-day hard-coded credentials vulnerability, CVE-2021-44207, which allowed the group to bypass authentication.

Members of the group were named in two separate indictments in 2019 and 2020 concerning their involvement in computer intrusions at 100 companies globally; however, the group remains highly active, and the indictments do not appear to have slowed down the group’s operations. The group is a key player in helping to make China’s 14th Five-Year Plan a success and achieve major scientific and technological advances in new generation artificial intelligence, quantum information, integrated circuits/semiconductors, neuroscience and brain-inspired research, genetics and biotechnology, clinical medicine and health, and deep sea, deep space, and polar exploration. The group is considered to be a significant threat to the healthcare and pharmaceutical industries in the United States.

The post Healthcare Industry Warned About Risk Posed by APT41 Threat Group appeared first on HIPAA Journal.