Some ransomware gangs have stated that they will stop targeting organizations healthcare during the coronavirus (COVID-19) pandemic.
Yesterday, BleepingComputer reached out to the hackers behind Maze, DoppelPaymer, Ryuk, Sodinokibi /REvil, PwndLocker, and Ako ransomware to learn their plans during this critical period.
DoppelPaymer ransomware
The DoppelPaymer hackers were the first to respond. They stated that hospitals and healthcare organizations in general are not their primary target and that they will continue the same approach during the coronavirus crisis.
“We always try to avoid hospitals and medical centers– we never touch 911. Not just now. If we do by mistake, we will decrypt the systems for free.”
When asked about the process for healthcare organizations that have fallen victim to the DoppelPaymer ransomware, the hackers said that the victim should contact them via email or the Tor website. If the organization provides proof, the hackers will decrypt the files.
Maze Ransomware
The hackers , on the other hand, published a "press release" stating that they will stop all "activity" against medical organizations until the end of the coronavirus.
However, they did not mention what happens if an organization's files are accidentally encrypted. They did not say anything about a free decryption tool
Security companies offer free help
Security companies Emsisoft and Coveware announced that they will offer services to healthcare organizations during the coronavirus pandemic.
These free ransomware services include:
- Technical analysis of ransomware.
- Develop a decryption tool (when possible).
- As a last resort, negotiate with the hackers about the ransom, manage transactions , and help restore systems. This means replacing the decryption tool provided by the criminalswith a custom tool that will recover data faster and with less chance of data loss.
This help is very important. The most effective solution, however, is for other gangs to decide not to carry out ransomware attacks on healthcare organizations, at least during this critical period of the coronavirus.
The epidemic knows no bounds. Anyone can get sick with this virus, including hackers.
Right now, healthcare workers need to focus on helping people and all systems and machines need to be working properly.
