Key Findings
- Ransomware operators targeting healthcare organizations disrupt patient services.
- Individuals on social media are at high-risk for high-volume spam attack patterns that spoof financial support programs.
- Changes in E-commerce patterns driven by lockdowns increases opportunity for cyberattacks using commodity malware.
Analysis
Ransomware Attacks on Healthcare Are Disrupting Services to Patients.
Threat actors attacked Universal Health Systems (UHS), a service provider to 400 hospitals and healthcare facilities in the U.S. and the U.K., reportedly with a variant of Ryuk. Staff in North Dakota and Arizona reported their systems were impacted as a result of the main UHS attack. The Arizona location reported inaccessibility to medication information, greatly impacting operations. The total number of victims is expected to be much greater.
An unreported ransomware variant caused a portion of IT systems at the Ashtabula County Medical Center in the US to shutdown. Nebraska Medical reduced operations to “pen and paper” after a separate attack, which is very likely ransomware based on a recent disclosed consultation with independent experts. The hospital is reported to have reduced and reprioritized appointments as a result. Further details of the attacks are not published at this time of writing.
REvil, NetWalker, Pysa, (Mespinoza), and SunCrypt, ransomware variants were also recently attacking other healthcare victims. All of the ransomware variants exfiltrate data prior to encryption, presenting a high-risk to patient data and proprietary research. REvil and Netwalker are both variants that employ Big Game Hunting TTPs (Tactics, Techniques, and Procedures).
Cyber insurance reports indicate ransomware threats to healthcare have a high success rate. In the first half of 2020 ransomware represented 41% of claims as measured by one insurance organization. Many incidents are not widely reported. Ransomware attacks against healthcare during the pandemic have been successful and will continue.
Threat Actors Exploit Independent-Led Financial Support Programs For Financial Gain.
Recent attacks used Facebook, WhatsApp and Telegram messaging platforms in concert to exploit individuals with spam for fraud. The campaign is based on an actual financial support program Facebook is directing towards small businesses. The attacks claim individuals who have had COVID-19 are applicable for financial support packages.
Earlier in 2020, EclecticIQ analysts reported threat actors started exploiting government support programs designed to help citizens via financial relief in response to COVID-19 economic impacts. Similar independent-led efforts that advertise using social media face very high risk of attack because such platforms expose attacks to greater pools of victims. Attackers take advantage of user content sharing features and also use email as a deliver vector.
Shifts In E-commerce And Contactless Payment Increases Opportunity For Cyberattacks.
A reduction in cash payments creates further incentives for ecommerce cyberattack; specifically, credential compromise and POS malware. Trends during the pandemic indicate organizations are shifting to eliminate cash payments in favor of contactless card payments. A large reduction in cash payments necessitates a greater volume of e-commerce transactions. The increase in e-commerce volume expands the attack surface that threat actors can hook into using different e-commerce TTPs and exploit individuals for fraud. If increased e-commerce traffic provides cybercriminals with more compromised account information from e-commerce exploitation, it is possible that the growth in online payments will increase the prevalence of mobile banking trojan use as cybercriminals key into more opportunities presented via higher volumes of e-commerce transactions.
As Europe’s leading cyber threat intelligence company, we at EclecticIQ have decided to make use of our resources and provide the community with custom reports on threats connected to the COVID-19 pandemic throughout the duration of the crisis. This is the 29th report in a weekly series of updates to inform of important developments to COVID-19-themed attacks.
