Microsoft Alerts Healthcare to Human-Operated Ransomware

Microsoft is alerting healthcare organizations to a rise in human-operated ransomware, which has been growing in frequency as attackers continue to take advantage of the COVID-19 crisis.

These types of ransomware campaigns typically seek easy entry into target businesses, many of which have transitioned to remote workforces to stop the coronavirus spread. As a result, ransomware operators have begun to target network devices such as gateway and VPN appliances. The healthcare sector is especially vulnerable to these types of attacks, Microsoft reports, and it has identified and alerted "several dozens of hospitals" with vulnerable gateway and VPN tools.

Microsoft's Threat Protection Intelligence Team and Threat Intelligence Center report more human-operated ransomware campaigns are exploiting vulnerabilities in network devices to gain a foothold in target organizations. REvil, also known as Sodinokibi, is an example of one campaign doing this. Once on a network, its operators aim to steal credentials, elevate their privileges, and move laterally across a network before installing ransomware or other malware.

Data shows an overlap between infrastructure Sodinokibi used last year and infrastructure it used in recent VPN attacks. "This indicates an ongoing trend among attackers to repurpose old tactics, techniques, and procedures (TTPs) for new attacks that take advantage of the current crisis," Microsoft explains in a blog post. While team members haven't seen technical changes, they did notice social engineering techniques designed to exploit people's fears surrounding COVID-19.

Their methods are meant to target institutions like healthcare organizations, which may not have had time or resources to strengthen their security posture by installing new patches, updating firewalls, or checking employees' privileges. To help them address these vulnerabilities, Microsoft explained to hospitals in its notification how attackers can break in and advised them how to apply security patches that could protect them from this threat.

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Untangling Third-Party Risk (and Fourth, and Fifth...)."