The latest data from the ransomware remediation firm, Coveware, shows the number of victims of ransomware attacks choosing to pay the ransom has fallen to a record low. At the start of 2019, 85% of victims of ransomware attacks paid a ransom following an attack, by the middle of 2021 the percentage had fallen to 46%, and in Q4, 2023, only 29% of victims paid the ransom. In 2019, ransomware groups started engaging in double extortion tactics, where access is gained to victims’ networks and data is exfiltrated before file encryption. Ransom payments are required to obtain the keys to decrypt files and to prevent stolen data from being leaked or sold. For many victims, the main reason for paying the ransom was to prevent a data leak rather than to obtain the keys to decrypt files. Coveware reports that in ransomware attacks involving data theft, in Q3, 2023, only 26% of victims paid the ransom.

There are many reasons behind the steady decline in ransom payments. One of the main factors is better preparedness, such as ensuring that a backup is made of all sensitive data and the backup is stored securely in an air-gapped system where it cannot be encrypted in an attack. In attacks where there is data theft, paying the ransom could prevent a data leak or the sale of the data; however, ransomware groups are not trusted to delete the stolen data. There have been attacks where payment of the ransom has not prevented a data leak, and paying up has led to further extortion attempts and attacks. There has also been a law enforcement crackdown and in some regions, paying a ransom is now illegal.

Prohibiting ransomware payments is one of the measures being considered by governments to curb attacks. If paying a ransom to a ransomware group is prohibited, ransomware groups would, in theory, stop conducting attacks in that country. Coveware suggests the reality would be different. The attacks would likely continue and companies would stop reporting attacks and seeking assistance from law enforcement. It would become much harder to track ransomware attacks and law enforcement investigations of ransomware groups would be severely hampered. All the good work by law enforcement to encourage victims to report attacks would be undone and as soon as a ban is implemented, a large illegal market would be created.

In the United States, several states have imposed partial bans on ransom payments, such as prohibiting state agencies and organizations from paying ransoms yet these bans do not appear to be having the desired effect, as ransomware attacks in those states have not reduced. Coveware believes that banning ransom payments amounts to capitulation. “A ban would signal that as a country, we are admitting that we are incapable of defending ourselves. That we are helpless against the threat of cyber extortion.”

Coveware’s data shows the efforts made by companies to prepare for ransomware attacks have paid off. Enterprises are no longer being crippled by file encryption and can recover their data without paying the ransom, and the efforts of law enforcement to disrupt and dismantle ransomware groups have produced meaningful results. “This fight will not be won overnight. It will take years, but the fight IS winnable,” said Coveware.

With revenues from ransomware attacks falling, ransomware groups need to conduct more attacks or increase their ransom demands, but Coveware’s data shows that ransom payments have reduced. In Q4, 2023, the average ransom payment was $568,705, down 33% from Q3, 2023. The median payment in Q4, 2023 was unchanged from the previous quarter and remained at $200,000.

In Q3, 2023 there was little change in the most active ransomware groups, with Akira retaining the top spot with 17% of attacks, followed by Blackcat with 10%, LockBit with 8%, and Play Ransomware with 6%; however, there has been an increase in activity by smaller ransomware groups and non-affiliated lone wolf actors. In around one-third of attacks, the method used to gain initial access to victims’ networks was unknown. Out of the other attacks, RDP compromise was the most common and has been increasing since Q3, 2022. Email phishing was the second most common initial access vector, although the popularity of this method declined over the same period. The exploitation of software vulnerabilities was the third most common initial access vector, with the Cisco ASA vulnerability (CVE-2023-20269) one of the most commonly exploited vulnerabilities.

Between Q2, 2022, and Q2, 2023, ransomware gangs favored attacks on large companies but the average size of victim companies has been falling with medium-sized companies seen as the sweet spot. Attacks are easier to conduct as investment in cybersecurity is lower than at large firms and mid-sized companies have sufficiently large revenues to allow large ransom demands to be issued. In Q4, 2023, the average size of a victim company was 231 employees, down 32% from Q3, 2023. In Q4, 2023, 22.2% of attacks were on companies in the professional services sector, with healthcare the second most attacked industry with 16% of attacks, followed by the public sector with 11.1% of attacks.

The post 71% of Ransomware Attack Victims Refuse to Pay the Ransom appeared first on HIPAA Journal.

Fortra has disclosed and patched a critical vulnerability in its GoAnywhere Managed File Transfer (MFT) solution. The vulnerability – CVE-2024-0204 – is an authentication bypass bug due to a path traversal weakness. If exploited, an unauthenticated user can create a new admin user via the administration portal and remotely take control of the customer’s environment and gain access to their network. The vulnerability has a CVSS severity score of 9.8 out of 10.

Fortra explained in its security advisory that the vulnerability affects all versions of GoANywhere MFT prior to 7.4.1. All users of the file transfer solution should ensure they update to version 7.4.1 as soon as possible. If it is not possible to immediately upgrade, Fortra has suggested temporary workarounds.

For non-container deployments, users should delete the InitialAccountSetup.xhtml file in the install directory and restart the services. For container deployments, the InitialAccountSetup.xhtml file should be deleted and replaced with an empty file, followed by a restart.

Managed file transfer solutions are attractive targets for hackers. Last year, the Clop ransomware group exploited a vulnerability in Fortra’s GoAnywhere MFT – CVE-2023-0669 – and attacked 129 of the company’s clients, including several healthcare organizations. Exploitation of the flaw is likely and according to Searchlight Cyber threat intelligence engineer, John Honey, a proof-of-concept exploit for the vulnerability is being circulated on at least one Telegram channel.

After upgrading to version 7.4.1 or implementing the workaround, an audit should be conducted to see if any new admin users have been added to the admin users group in the GoAnywhere administrator portal Users -> Admin Users section. The cybersecurity firm Horizon3 also recommends checking the logs for the database -\GoAnywhere\userdata\database\goanywhere\log\*.log. – as they include the transactional history of the database and will contain entries if new admin users have been added.

The post Patch Fortra GoAnywhere Now: Exploit Code Released for Critical Flaw appeared first on HIPAA Journal.

The ScreenConnect remote access tool has been abused by a threat actor to gain access to the networks of organizations in the healthcare and public health (HPH) sector. According to a sector alert from the Health Sector Cybersecurity Coordination Center (HC3), between October 28 and November 8, 2023, an unknown threat actor abused a locally hosted ScreenConnect instance to gain remote access to victims’ networks.

Once access was gained, the threat actor installed further remote access tools including SecureConnect and AnyDesk instances to allow persistent access to victims’ networks. Researchers at the cybersecurity company Huntress identified two attacks on distinct healthcare organizations and the threat actor’s activity suggests network reconnaissance was being conducted in preparation for attack escalation.

On November 14, the vendor of ScreenConnect said the threat actor gained access to an unmanaged on-premises instance of ScreenConnect that had not been updated since 2019. The ScreenConnect vendor said the organizations affected had gone against recommended best practices. In the attack, the threat actor leveraged local ScreenConnect instances used by the pharmacy supply chain and management systems solution provider Transaction Data Systems (now Outcomes). The company makes Rx30 and ComputerRx software that is used by pharmacies in all 50 states. The Huntress researchers have not been able to determine the impact of the attack, but say it could be substantial.

HC3 has provided Indicators of Compromise (IoCs) associated with the attack and advises all clients of the pharmacy supply chain and management systems solution provider to take immediate action and examine their systems and networks for the IoCs. If any of the IoCs are identified they should be taken seriously and warrant a prompt and thorough investigation and comprehensive breach response.

According to HC3, the compromised endpoints used an unmanaged instance of a Windows Server 2019 system and organizations should take concerted steps to safeguard their infrastructure. HC3 recommends implementing enhanced endpoint monitoring solutions, robust cybersecurity frameworks, and engaging n proactive threat hunting to mitigate potential threat actors’ intrusions.

The post HC3 Warns of Threat of Unauthorized Remote Access via ScreenConnect Tool appeared first on HIPAA Journal.

U.S. hospitals are being targeted by cybercriminals in a sophisticated payment fraud scam, according to the American Hospital Association (AHA). The AHA has received multiple reports of scammers contacting hospital IT departments to perform password resets and enroll new devices to obtain multifactor authentication (MFA) codes. Once access has been gained to employee email accounts, they send instructions to payment processors to divert legitimate payments to attacker-controlled U.S. bank accounts. The funds are then transferred to overseas accounts.

According to the AHA, scammers contact IT departments and pose as revenue cycle employees or other employees in sensitive financial roles. They provide stolen personal information to verify their identity to pass the security checks that are necessary to perform a password reset to enroll a new device to receive MFA codes. The devices used to receive the codes often have a local area code. With a new device enrolled, the scammer will receive MFA codes, allowing them to access employee email accounts. This technique also allows the scammers to defeat phishing-resistant MFA.

The AHA has received dozens of reports from U.S. hospitals that have been targeted and had payments diverted to attacker-controlled accounts. Anyone who falls victim to such a scam should immediately report it to the Federal Bureau of Investigation (FBI) and their financial institution to try to get the transfer blocked and recover the fraudulently transferred funds. The FBI has been able to successfully block fraudulent transfers of funds if notified within 72 hours of the transfer being made.

Hospitals should consider implementing stricter IT help desk security protocols to ensure they do not fall victim to these scams. John Riggi, AHA’s national advisor for cybersecurity and risk, suggests that as a minimum, any requests for password resets should require a call back to the number on record for the employee requesting a password reset and enrollment of a new device. Some hospitals have implemented procedures that require any such request to be made in person at the IT help desk. Riggi also suggests implementing policies that require the supervisor of the employee to be contacted to verify any such request. “This scheme once again demonstrates how our cyber adversaries are quickly evolving their tactics to defeat technological cyber defenses through social engineering schemes,” said Riggi.

The post Hospital IT Help Desks Targeted in Sophisticated Payment Fraud Scam appeared first on HIPAA Journal.

Two zero-day vulnerabilities have been identified in customer-managed Citrix NetScaler Application Delivery Controller and NetScaler Gateway devices that are being exploited in the wild. The vulnerabilities are present in the NetScaler management interface can be exploited in unpatched devices that are exposed to the Internet.

The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerabilities to its Known Exploited Vulnerabilities Catalog, and while attacks have been limited, CISA warns that the vulnerabilities are frequent attack vectors for malicious cyber actors and exploitation is likely to increase in the coming days. In December, Citrix released an advisory about a vulnerability dubbed CitrixBleed (CVS-2023-4966) which has been extensively exploited by ransomware groups. As such, CISA has advised all federal agencies to ensure the patches are applied as soon as possible and at most within a week.

The two recently disclosed zero-day bugs are unrelated to CitrixBleed.  CVE-2023-6549 is a high-severity buffer overflow vulnerability with a CVSS base score of 8.2. The flaw can be exploited in a denial-of-service attack. CVE-2023-6548 is a medium-severity code injection vulnerability with a CVSS base score of 5.5, which can be exploited to achieve remote code execution. In order to exploit the latter, an attacker would need to be authenticated but only requires low-level privileges.

The vulnerabilities are far less severe than CitrixBleed, nonetheless, customers have been advised to promptly apply the patches as the vulnerabilities are under active exploitation. Proof-of-concept exploit code is not believed to have been publicly released but that is likely to happen soon and exploitation will increase considerably.

The vulnerabilities are present in the following NetScaler ADC and NetScaler Gateway versions:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-12.35
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-51.15
• NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.21
• NetScaler ADC 13.1-FIPS before 13.1-37.176
• NetScaler ADC 12.1-FIPS before 12.1-55.302
• NetScaler ADC 12.1-NDcPP before 12.1-55.302

Citrix has released patches to fix both vulnerabilities and has suggested a workaround if that is not possible.

The post Citrix Patches 2 Actively Exploited NetScaler ADC and Gateway Zero Days appeared first on HIPAA Journal.

Urgent action is required to fix two zero day flaws in Ivanti Connect Secure VPN and Policy Secure NAS appliances. The vulnerabilities were discovered by researchers at Volexity and were disclosed by Avanti last week. While they have been exploited in the wild since December 2023 by an Advanced Persistent Threat group, the attacks have been highly targeted and at the time of the disclosure, fewer than 20 customers had been attacked but the situation has now changed. On January 11, 2023, multiple threat actors started mass exploiting the flaws in indiscriminate attacks on businesses of all sizes across multiple sectors.

Ivanti will be releasing patches to fix the flaws starting in the week of January 22, 2024, and final patches will be released in the week of February 19, 2024; however, there is a workaround that can prevent exploitation of the flaws until the patches are released Any HIPAA-regulated entity that uses one of the vulnerable products should ensure that the workaround is implemented immediately given the extent to which the flaws are being exploited.

The vulnerabilities are CVE-2023-46805, an authentication bypass flaw (CVSS 8.2) that is present in of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure, and CVE-2024-21887, a command injection vulnerability (CVSS 9.1) in Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure. The authentication bypass flaw allows an unauthenticated remote attacker to bypass security controls and access restricted resources, and the command injection flaw allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

The initial attacks were conducted by an unknown APT group that downloaded malware tool kits for espionage purposes. The latter attacks have been conducted by multiple threat actors. One actor has already attacked hundreds of appliances and backdoored targets’ systems using a GIFTEDVISITOR webshell variant. According to Volexity, as of January 14, 2023, more than 1,700 ICS VPN appliances had been compromised with the webshell.

In addition to applying the mitigation measures, customers have been advised to run the Ivanti Integrity Checker Tool to identify signs of compromise.

The post Multiple Threat Groups Exploiting Ivanti VPN/NAS Zero-Days appeared first on HIPAA Journal.