The biomedical community is working hard to develop vaccines against SARS-CoV-2 and discover new treatments for COVID-19 and nation-state hackers and cybercriminal organizations are targeting those organizations to gain access to their research data.

Recently, security agencies in the United States, Canada, and the United Kingdom issued alerts about state-sponsored Russian hackers targeting organizations involved in COVID-19 research and vaccine development. The security agencies had found evidence that the Russian hacking group APT29 was actively conducting scans against the external IP addresses of companies engaged in COVID-19 research and vaccine development, and that it was almost certain that the hackers were working with the Russian intelligence services.

An joint alert was also issued by the U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency and the FBI indicating hackers linked to China were conducting similar attacks on pharmaceutical companies and academic research facilities to obtain intellectual property and sensitive data related to COVID-19. There have also been reports that hackers in Iran are conducting similar attacks.

In light of the recent attacks and targeting of research facilities, BitSight conducted a study to determine how well COVID-19 vaccine manufacturers and biomedical companies are performing at protecting their systems and data from hackers. BitSight researchers assessed 17 companies for the study, each of which has a major role in COVID-19 research and vaccine development. Those companies ranged from small firms with fewer than 200 employees to large companies with more than 200,000 employees.

BitSight found several security vulnerabilities that could be exploited by hackers to gain access to intellectual property and vaccine and COVID-19 research data. The security vulnerabilities were divided into four areas: Open ports, unpatched vulnerabilities, web application security, and systems that had already been compromised.

BitSight found 8 of the 17 companies had their systems compromised in the past year and had computers that were part of a botnet, and 7 companies had computers added to a botnet in the past 6 months. BitSight searched for software running on systems that the companies likely did not install. These Potentially Unwanted Programs (PUPs) were found on 9 company systems and 8 companies had PUPS installed in the past 6 months. Five companies had computers that were sending spam and the researchers identified unsolicited communications at three companies. Compromised systems show the companies’ security controls have failed and that the companies could, or already have been, hacked by adversaries seeking access to COVID-19 data.

The majority of companies had open ports which exposed insecure services over the internet, including 7 companies with exposed Microsoft RDP and a further 7 with LDAP exposed. 5 companies had exposed MySQL, MS SQL or Postgres SQL databases and a further 5 had an exposed Telnet service. The exposed Microsoft RDP was of particular concern, since hackers and ransomware gangs are actively searching for exposed RDP devices.

14 of the 17 companies were found to have unpatched vulnerabilities that could potentially be exploited remotely by hackers.  10 companies had more than 10 unpatched vulnerabilities and 6 had unpatched vulnerabilities with a CVSS score greater than 9.

Web application security issues were also common, such as insecure redirects from HTTPS to HTTP, insecure authentication, and a mixture of secure and insecure content on web pages. Many of the companies had more than one web application security issue. These security issues placed the companies at risk of man-in-the-middle and cross-site scripting attacks, which could potentially result in hackers capturing sensitive data, obtaining credentials, and compromising email systems.

“In light of these risks, the bioscience community must step up its cyber vigilance. It only takes a misconfigured piece of software, an inadvertently exposed port, or an insecure remote office network for a hacker to gain entry to systems that store scientific research, intellectual property, and the personal data of subjects involved in clinical trials,” warned BitSight. “[Companies] must revisit basic cybersecurity hygiene practices and find proven and efficient ways to continuously discover and manage risk exposure — across the extended attack surface and third-party ecosystem. Only then can remediation be prioritized, and life-saving science innovation assured.”

The post Study Reveals COVID-19 Research Companies are Vulnerable to Cyberattacks appeared first on HIPAA Journal.

The Emotet botnet has been reactivated after a 5-month period of dormancy and is being used to send large volumes of spam emails to organizations in the United States and United Kingdom.

The Emotet botnet is a network of compromised computers that have been infected with Emotet malware. Emotet malware is an information stealer and malware downloader that has been used to distribute a variety of banking Trojans, including the TrickBot Trojan.

Emotet hijacks email accounts and uses them to send spam emails containing malicious links and email attachments, commonly Word documents and Excel spreadsheets containing malicious macros. If the macros are allowed to run, a PowerShell script is launched that silently downloads Emotet malware. Emotet malware can also spread to other devices on the network and all infected devices are added to the botnet.

The emails being used in the campaign are similar to previous campaigns. They use fairly simple, yet effective lures to target businesses, typically fake invoices, purchase orders, receipts, and shipping notifications. The messages often only include one line of text requesting the recipient click a link or open the email attachment. The emails are often personalized and contain the name of the targeted company and typically have a subject line starting with “RE:” that suggests the email has been sent in response to an email previously sent by the targeted individual – RE: Invoice 422132, for example. Several of the emails in this campaign have an attachment called “electronic.form.”

The latest campaign was been detected by several security companies. The first test emails were sent on July 13, and the spam campaign commenced on July 17. Proofpoint detected 30,000 messages on July 17, but now around 250,000 emails are being sent each day.

Malwarebytes rates Emotet as the biggest malware threat of 2018 and 2019, even with the regular breaks in botnet activity. Typically, activity stops around holiday periods for a few days or weeks, but the latest hiatus is one of the longest breaks in activity since the malware first appeared.

Emotet itself is a dangerous malware variant, but it is the additional payloads that Emotet downloads that cause the most damage. The TrickBot Trojan is a modular malware that can perform a range of malicious functions, such as stealing login information, sensitive files and emails, and Bitcoin wallets. The TrickBot Trojan often downloads Ryuk ransomware after the operators have achieved their own objectives.

If Emotet malware is detected, a rapid response is required to isolate the infected device and remove the malware. If Emotet is found on one device, it is likely that other devices will also have been compromised.

To reduce the risk of infection, organizations should send an alert to their employees warning them of the threat and advising them to take extra caution, especially with emails containing Word documents and Excel spreadsheets, even if those emails appear to have been sent from trusted contacts.

The post Emotet Botnet Reactivated and Sending Large Volumes of Malicious Emails appeared first on HIPAA Journal.

The APT29 hacking group, aka Cozy Bear, is targeting healthcare organizations, pharma firms, and research entities in the United States, United Kingdom, and Canada and is attempting to steal COVID-19 research data and information about vaccine development.

On July 16, 2020, a joint advisory was issued by the DHS’ Cybersecurity and Infrastructure Security Agency (CISA), UK National Cyber Security Centre (NCSC), Canada’s Communications Security Establishment (CSE), and the National Security Agency (NSA) to raise awareness of the threat.

APT29 is a cyber espionage group that is almost certainly part of the Russian intelligence services. The group primarily targets government entities, think-tanks, diplomatic and energy targets in order to steal sensitive data. The group has been highly active during the COVID-19 pandemic and has conducted multiple attacks on entities involved COVID-19 research and vaccine development.

The group conducts widespread scanning to identify unpatched vulnerabilities and uses publicly available exploits to gain a foothold in vulnerable systems. The group has successfully used exploits for the Citrix vulnerability CVE-2019-19781, the Pulse Secure vulnerability CVE-2019-11510, the FortiGate vulnerability CVE-2019-13379 and the Zimbra vulnerability CVE-2019-9670. Other exploits may also be used by the group.

APT29 uses variety of tools to obtain access credentials and achieve persistent access to systems and uses anonymizing services when using stolen credentials. APT29 is using custom malware variants to attack organizations, including WellMess and WellMail, two malware variants that have not previously been used by APT29.

WelMess is a lightweight malware variant written in Golang or .NET that can execute arbitrary shell commands and upload and download files and uses HTTP, TLS and DNS for communication. WellMail is a lightweight tool that uses hard-coded client and certificate authority TLS certificates to communicate with C2 servers. A third malware variant, named SoreFang, is also being used. SoreFang is a first stage downloader that exfiltrates data via HTTP and downloads a second state malware. The malware is used to target SangFor devices.

Attacks on organizations involved in COVID-19 research are likely to continue and any organization involved in COVID-19 research should consider itself a target. Organizations have been advised to take steps to secure their systems and monitor for attacks.

Organizations should ensure that all software is patched and up to date, and the patches for CVE-2019-19781, CVE-2019-11510, CVE-2019-13379 and CVE-2019-9670 should be prioritized. Antivirus software should be used and kept up to date, and regular scans should be conducted to identify downloaded malware variants.

Multi-factor authentication should be implemented to prevent stolen credentials from being used to gain access to systems. All staff should be educated about the threat from phishing and all employees should be confident in their ability to identify a phishing attack. All staff should be instructed to report any suspected phishing attacks to their security teams and reports should be investigated promptly and thoroughly.

Organizations have been advised to set up a security monitoring system to ensure that all necessary data is collected to support investigations into network intrusions. Networks should be segmented, and steps taken to prevent and detect lateral movement within networks.

The post Russian APT Group is Targeting Organizations Involved in COVID-19 Research appeared first on HIPAA Journal.

The New Zealand-based cybersecurity firm Emsisoft has released ransomware statistics for 2020 that show there have been at least 41 successful ransomware attacks on hospitals and other healthcare providers in the first half of the year.

There were 128 successful ransomware attacks on federal and state entities, healthcare providers, and educational institutions in the first 6 months of 2020, with the healthcare industry accounting for 32% of those attacks.

The large number of ransomware attacks in 2020 follows on from a spike in attacks in late 2019. 2019 saw more than double the number of ransomware attacks as 2018, attacks on healthcare providers increased by 350% in the final quarter of 2019. 966 entities were successfully attacked with ransomware across all industry sectors in 2019 and those attacks are estimated to have cost $7.5 billion.

2020 started badly for the healthcare industry with 10 successful ransomware attacks on healthcare providers in January, followed by a further 16 successful ransomware attacks in February. There was a marked decrease in attacks in March as COVID-19 spread throughout the United States. Three successful ransomware attacks were reported by healthcare providers in March and April and a further 4 attacks in May. While it is certainly good news that the number of successful attacks has declined as the year has progressed, the figures do not indicate any lowering of risk. The number of successful attacks has declined, but the number of attempted attacks has remained fairly constant. Emsisoft has predicted an increase in ransomware attacks on healthcare providers over the summer, as often happens at this time of year. Employees are also starting to return to the office. Ransomware attacks decreased as the COVID-19 pandemic hit the United States, but Emsisoft has started to see attacks increase once again.

One in Ten Ransomware Attacks See Data Stolen Prior to Encryption

Several threat actors are now conducting double extortion attacks, where data is stolen before the ransomware payload is deployed. The Maze ransomware gang was the first to start stealing data and issuing threats to publish the files if the ransom is not paid. The gang followed through on the threat and started publishing data on its website in November 2019. Several other ransomware gangs have also adopted similar tactics, including REvil/Sodinokibi, DoppelPaymer, and NetWalker.

With these groups, ransomware is often deployed many days, weeks, or even months after the initial system breach. During that time, the attackers move laterally to gain access to as many devices as possible and then time their attacks to cause maximum disruption. It is likely that several healthcare providers have already had their systems compromised, but the ransomware has not yet been deployed.

These prolific ransomware gangs have concentrated their attacks on entities in sectors that have the most to lose from the publication or sale of their data, including legal firms, healthcare providers, and firms in the financial sector. These attacks often make headline news, but they only account for around 1 in 10 successful ransomware attacks. From January 1, 2020 to June 30, 2020, ID Ransomware received 100,001 submissions about ransomware attacks and only around 11% – 11,642 submissions – involved ransomware variants used by groups known to steal data prior to encrypting files.

Emsisoft notes however that while several ransomware gangs alert the victim to the theft of their data to increase the probability of the ransom being paid, other ransomware gangs are likely to covertly steal data.

“All ransomware groups have the ability to exfiltrate data. While some groups overtly steal data and use the threat of its release as additional leverage to extort payment, other groups likely covertly steal it,” explained Emsisoft. While groups that steal covertly may not exfiltrate as much data as groups seeking to use it as leverage, they may well extract any data that has an obvious and significant market value or which can be used to attack other organizations.”

Ransomware Prevention and Damage Limitation

As long as ransomware attacks remain profitable and relatively low risk, the attacks will continue. Healthcare organizations therefore need to take steps to improve their defenses against attacks. To prevent attacks and limit the harm caused if they are successful, Emsisoft recommends healthcare organizations should patch promptly, limit admin rights, use multi-factor authentication, disable PowerShell when not needed, use web and email filtering, segment the network, and disable RDP if it is not being used… and lock it down if it is. Employees should be provided with regular security awareness training and all vendors that have access to healthcare systems should be audited to make sure they are adhering to best practices.

The post At Least 41 Healthcare Providers Experienced Ransomware Attacks in the First Half of 2020 appeared first on HIPAA Journal.