In July 2021, the notorious REvil (Sodinokibi) ransomware gang appeared to have ceased operations, with both its Tor payment site and data leak blog suddenly going offline. The DarkSide ransomware operation also went quiet, leading many security experts to believe that the operators of the ransomware-as-a-service (RaaS) operations were laying low or that there had been a law enforcement takedown of their infrastructure. Some of the servers used by the REvil gang were brought back online temporarily but were shut down again in mid-October. This temporary resurrection was thought to be an affiliate attempting to continue the operation.

The apparent shutdown of the REvil operation followed two major attacks on the food production company JBS and the software management company Kaseya, with the later attack affecting around 50 managed service providers and up to 1,500 downstream businesses. Associates of the REvil gang had developed the DarkSide ransomware variant, which was used in the attack on Colonial Pipeline and caused its fuel pipeline to the Eastern seaboard of the United States to be shut down for a week. While ransomware had always posed a threat to critical infrastructure, these attacks made it clear that critical infrastructure was certainly not off-limits for ransomware gangs.

After the attacks, the White House announced more resources would be made available to deal with the ransomware threat, with the attacks elevated to a level similar to terrorism. President Biden met with Russian President Vladimir Putin and urged him to take action against ransomware gangs operating within its borders, and the United States has been working with cybersecurity leaders to discuss other cybersecurity initiatives to mitigate the threat. As part of the ongoing efforts to deal with the ransomware threat, earlier this month President Biden announced the United States would be participating in a meeting with leaders in more than 30 countries to combat ransomware.

REvil Operation Targeted by Law Enforcement

It has now become clear that the shutdown of the REvil operation was the result of an international law enforcement effort, according to a recent Reuters report. Tom Kellerman, VMWare’s head of cybersecurity strategy and advisor to the US Secret Service said, “The FBI, in conjunction with Cyber Command, the Secret Service, and like-minded countries, have truly engaged in significant disruptive actions against these groups.”

REvil emerged in 2019 as an offshoot of the GandCrab ransomware operation and soon became the most prolific ransomware group, accounting for 73% of all ransomware detections in Q2, 2021. When it came to taking action against these groups, “REvil was top of the list”, said Kellerman.

In July, before the REvil gang went dark, law enforcement gained access to some of its network infrastructure and servers, with Kellerman confirming law enforcement had prevented attacks on several companies. Mimicking the actions of the REvil gang, law enforcement also compromised its backups. The REvil gang attempted to restore its servers from backups in the belief that they had not been compromised, but the restored infrastructure was under the control of law enforcement.

One of the leaders of the REvil operation who is known as “0_neday”, recently posted on a cybercrime forum confirming an unnamed party had compromised its servers and claimed, “They were looking for me… Good luck, everyone; I’m off.”

The shutdown almost certainly spells the end of the REvil operation; however, when takedowns occur, it is common for ransomware gangs to simply rebrand and start a new operation. The affiliates that have signed up for RaaS operations often jump ship and sign up with other RaaS operations, so while REvil was a major operator, it does not mean that ransomware attacks will slow. After news of the takedown emerged, members of other ransomware gangs posted online showing solidarity with the REvil operation. One member of the Groove operation called for other ransomware groups to respond to the takedown and increase their attacks on targets in the United States.

The post International Law Enforcement Operation Takes Down REvil Ransomware Gang’s Infrastructure appeared first on HIPAA Journal.

A recent survey conducted on Chief Information Security Officer (CISO) members of the College of Healthcare Information Management Executives (CHIME) and Association for Executives in Healthcare Information Security (AEHIS) has highlighted the impact cybersecurity incidents have had on the healthcare industry and the need for federal assistance to deal with the threats.

The healthcare industry has long been targeted by cybercriminals, but attacks have increased during the pandemic. 67% of respondents said their organization had experienced a security incident in the past 12 months with almost half saying they were the victim of a phishing attack. Phishing and business email compromise attacks, malware ransomware, hacking, and insider threats were the most common security exploits used in cyberattacks on the industry.

Cyberattacks can cause patient safety issues. One recent study indicates mortality rates increase following a ransomware attack, as do medical complications and the length of hospital stays. The survey confirmed the impact on patient safety, with 15% of respondents saying there had been a patient safety issue after a cyberattack and 10% saying they were forced to divert patients to other facilities in the wake of an attack.

The increase in attacks has meant an increase in costs. More than 80% of surveyed CISOs reported an increase in costs associated with cyberattacks in the past year. 20% of respondents said costs had increased by 50% in the past year, with one in 6 saying costs have doubled. Not only have remediation costs increased, but the cost of cyber insurance policies has also risen due to the increased risk of cyberattacks.

Indeed, the situation is likely to get worse as there are several emerging threats of major concern, such as the rise in IoT and other connected devices, an increasingly remote workforce, supply chain threats, API security issues, and risks associated with 3^rd party consumer health apps.

Funding for cybersecurity has long been a problem in healthcare, but the increase in costs has made the situation far worse and many CISOs are struggling. “We are overwhelmed with unfunded federal mandates. Our organization is struggling through the pandemic while having mandate after mandate applied. [This is] not sustainable,” said one respondent to the survey.

The survey confirmed healthcare providers need more help dealing with the increased threat of attacks. Congress is considering several new measures to improve defenses against cyberattacks for critical infrastructure, including healthcare, but CHIME and AEHIS say healthcare is often left on the periphery, even though the healthcare industry is one of the most targeted parts of critical infrastructure and one of the most vulnerable.

40% of respondents said they need help in the form of grants or federal assistance to improve cybersecurity, a third said they would benefit from regional extension centers with cyber experts on hand who could come on-site to provide guidance and expertise, and 16.7% said they would benefit from closer relationships with federal authorities such as the FBI and CISA.

52% of respondents said they had signed up with an Information Sharing & Analysis Center (ISAC) or Information Sharing and Analysis Organization (ISAO), but further guidance is needed, as 10% of respondents said they were unsure when it was acceptable to share threat information. When guidance is provided, it needs to be communicated more effectively. For instance, 45% of respondents said they were unaware of 405(d) best practices that had been published by the HHS.

“From this survey it is clear that healthcare providers will need several tools in their arsenal to fight an ever-escalating and complex battle that is being brought directly to their doorstep and threatens their delivery of patient care,” said AEHIS Advisory Board Chair Will Long. “More resources, education, and ongoing support for our sector are needed.”

The post Healthcare CISOs Need Federal Assistance to Deal with Increase in Cyber Threats appeared first on HIPAA Journal.

Ransomware is currently the biggest cyber threat faced by the healthcare industry. Attacks often cripple healthcare IT systems for weeks or months and prevent medical records from being accessed. One study by the Ponemon Institute/Censinet shows attacks result in treatment delays, an increase in complications, poorer patient outcomes, and an increase in mortality rates.

Several ransomware gangs have publicly stated they will not attack the healthcare industry, but that is certainly not true of FIN12. According to a recently published analysis of the ransomware actor by Mandiant, around 20% of the attacks conducted by the group have been on the healthcare industry.

FIN12 is a prolific ransomware actor that focuses on big game targets. Almost all the victims of FIN12 have annual revenues over $300 million, with an average of almost $6 billion. FIN12 has been active since at least 2018 and has largely targeted North America where 85% of its attacks have occurred, although the gang has recently expanded geographically and now also conducts attacks in Europe and the Asia Pacific region. The most frequently targeted industries are healthcare, education, financial, manufacturing, and technology.

Mandiant says FIN12 is the most prolific ransomware actor it tracks that focuses on high value targets. Around 20% of all ransomware incidents the company responds to are conducted by FIN12, which makes it the most frequently encountered ransomware deployment actor.

The reason why FIN12 targets the healthcare industry when many ransomware-as-a-service operations do not attack the healthcare sector is not entirely clear. Mandiant suggests the need for healthcare providers to regain access to patient data quickly is likely the key factor. Healthcare providers are more likely to pay the ransom and more likely to pay the ransom quickly, whereas negotiations with victims in other sectors may drag on for weeks.

Mandiant believes FIN12 is a specialist ransomware deployment actor that uses initial access brokers (IABs). IABs provide the access and credentials FIN12 requires to conduct its attacks. IABs typically receive a cut of any ransom payments that are generated, although some ransomware operations pay a flat rate for access. Mandiant has seen evidence that FIN12 pays a percentage of the ransom to the IAB, usually around 30%-35%.

One of the IABs extensively used by FIN12 is TrickBot, a botnet operation that sells persistent access to victims’ networks. The group has also partnered with the BazarLoader operation, and more recently has branched out and appears to have purchased credentials to login to Citrix environments. FIN12 most commonly deploys Ryuk ransomware, a ransomware variant that is capable of spreading throughout a network and infecting and encrypting data on multiple systems.

In contrast to many ransomware actors which spend weeks inside a victim’s network before deploying ransomware, FIN12’s attacks are rapid and have an average time-to-ransom (TTR) of less than 4 days. The gang appears to be prioritizing speed in its attacks as the TTR has been decreasing. Some of the recent attacks have had a TTR of just 2.5 days. “These efficiency gains are enabled by their specialization in a single phase of the attack lifecycle, which allows threat actors to develop expertise more quickly,” says Mandiant.

Mandiant says the gang stands out from other ransomware actors as multifaceted extortion is relatively rare. It is now very common for data to be exfiltrated prior to the use of ransomware and for ransomware gangs to threaten to publish the stolen data if victims do not pay. Mandiant suggests the decision not to engage in data theft is likely due to the effect it would have on the TTR. In attacks where FIN12 has exfiltrated data, the TTR was around 12.5 days.

While victims may be more likely to pay the ransom due to the threat of public shaming and data exposure, there is also a much higher risk of detection prior to file encryption. “FIN12’s apparent success without the need to incorporate additional extortion methods likely suggests the notion that they do not believe spending additional time to steal data is worth the risk of having their plans to deploy ransomware thwarted,” suggests Mandiant.

The post FIN12 Ransomware Gang Actively Targeting the Healthcare Sector appeared first on HIPAA Journal.