Federal agencies are warning hospitals and security researchers about a rapid increase in cyberthreats targeting U.S. healthcare facilities . Specifically, the FBI, the U.S. Department of Homeland Security (DHS), CISA and the Department of Health and Human Services said that hackers are targeting the healthcare sector, carrying out ransomware attacks that can lead to data theft and disruption of healthcare services.
The agencies note that hackers may be using Ryuk ransomware for financial gain. The warning from the FBI, CISA, DHS, and the Department of Health and Human Services about ransomware threats comes at a time when cases and hospitalizations of COVID-19 have increased alarmingly in both the US and the rest of the world.
Cybersecurity firm FireEye said multiple US hospitals were hit by a "coordinated" ransomware attack, with at least three public hospitals confirming they were hit this week.
Ransomware is a type of computer virus that locks computers until the victim pays a ransom to receive a decryption. The attack was carried out by “UNC1878,” a hacking group linked to Eastern Europe that operates for financial gain. At least three hospitals were severely affected by ransomware this week, and many more have been hit in recent weeks. UNC1878 plans to target and deploy ransomware to hundreds more hospitals.
Many hospitals have already been significantly affected by ransomware threats such as Ryuk ransomware and networks have been taken down. Researchers say UNC1878 is one of the most dangerous threats they have seen in their careers.
Attackers using the Trickbot malware said this week that they had attacked more than 400 hospitals in the US, according to Alex Holden, founder of cybersecurity research firm Hold Security.
For example, St. Lawrence Health System in New York, Sonoma Valley Hospital in California, and Sky Lakes Medical Center in Oregon said they were affected by ransomware attacks.
Ransomware typically begins its attacks with emails that appear to be corporate communications and sometimes include the victim’s or their company’s name in the body or subject line, according to a FireEye report released this week. However, the emails may also contain malicious Google Docs, usually in PDF format, that contain a link to the malware. The use of multiple links, as well as PDF files, can trick email filters designed to detect simpler phishing.
