How Human-Operated Ransomware Attacks Are Targeting Healthcare Organizations
Post Summary
These attacks involve human adversaries who infiltrate networks, adapt to vulnerabilities, and spend months stealing credentials, moving laterally, and waiting for the best opportunity to exploit a system.
Healthcare organizations are a top target because they store valuable patient data and often have less robust cybersecurity measures compared to other industries like finance.
The #1 defense is a robust data backup and recovery system, which ensures quick restoration of data and eliminates reliance on ransom payments.
Train staff on cybersecurity policies and awareness. Perform initial and ongoing risk assessments for all technologies, especially remote access tools. Keep backup systems up-to-date and test recovery plans regularly.
Vulnerabilities often occur through VPNs and remote access connections, especially when flaws in remote access products are overlooked or unmanaged.
With experience in sysadmin functions, malicious bad actors are taking advantage of common misconfigurations in network security, probing defenses, and adapting to what is revealed. Lately it has been observed that human adversaries are sometimes spending months stealing and adding credentials and leaving indiscernible footprints that enable lateral movement in compromised networks. They are not hit-and-run operations breaking in, encrypting data, and making immediate ransom demands.
Small, everyday detection alerts that seem easy to dismiss, may be signs of a compromised network being probed by someone already hacked into the network learning what the threshold is for scrutiny. These long-game invasions aren’t always concerned about stealth. By utilizing built-in local administrator accounts, common account names, or even service accounts of known vendors, these bad actors may be moving around freely without attracting attention.
It may be the devastating ransomware news story that gets attention, but what you’re not hearing is how things got to that point. While exploring network vulnerabilities, these human adversaries may utilize single machines for other purposes, as recently observed: sending a short burst of SPAM email or having an internal machine complete a network scan for other vulnerabilities in a matter of seconds. In other words, many of these ransomware attacks are patiently waiting for the best opportunity to exploit a found vulnerability.
Healthcare organizations (HCOs) are the second most popular target behind financial institutions because of the payoff amounts attackers can get when successful. And HCOs spend far fewer dollars on cybersecurity than the financial sector.
The #1 defense against ransomware is having an excellent data backup and recovery system. The reason ransomware works is that it denies access to or alters essential enterprise or patient data. If you have a copy of that data which is not locked or altered and a procedure to quickly restore it, you have your way out of the data prison. Sure, an adversary could also threaten to release captured data to prove a compromised system, but this is different from a ransomware attack that stops patient care or hospital operations. It doesn’t mean you should not also be taking other steps to reduce data risk, but you can’t get locked out of your house for long if you keep a spare copy of the keys somewhere safe.
The human factor is highly impactful in preventing cybersecurity failures. Kaspersky conducted a survey among healthcare workers and found that 32% had never received cybersecurity training from their workplace. Additionally 10% of managers weren’t aware of a cybersecurity policy.
Some of the most vulnerable attack vectors right now are through VPN and remote access connections. HCOs have far less experience in managing remote access than other systems. Flaws in the newer crop of remote access products leave even more vulnerabilities and therefore opportunities ripe for exploitation. This is another reason why completing initial risk assessments and conducting re-assessments with product updates is essential. You can’t easily guard against things of which you are not even aware. Even established remote access like Citrix have been shown to include vulnerabilities. Our advice for combating ransomware threats starts with robust backup and recovery systems. Train all staff on cybersecurity policies and conduct awareness training to minimize threats even beyond ransomware. And keep risk assessments up-to-date for 100% technology vendors, especially as those products change. Awareness is essential to know where and when to act. For a deep dive into the strategy of human-operated ransomware attacks, we recommend reading Microsoft’s report on prevention.
Key Points:
What are human-operated ransomware attacks, and how do they work?
- Human-operated ransomware attacks involve skilled adversaries who infiltrate networks and adapt to discovered vulnerabilities.
- Attackers often spend months stealing credentials, performing lateral movement, and leaving minimal footprints before exploiting a system.
- Unlike hit-and-run ransomware attacks, these long-game tactics involve probes and reconnaissance to identify weak points and determine thresholds for detection.
Why are healthcare organizations targeted by ransomware?
- Healthcare organizations store valuable patient data, which makes them a lucrative target for cybercriminals.
- The average cost of a healthcare data breach exceeds $7 million, making ransom payments highly profitable for attackers.
- Compared to industries like finance, healthcare spends significantly less on cybersecurity as a percentage of IT budgets.
- The reliance on third-party vendors, cloud software, and network-connected devices increases their attack surface.
What are the key vulnerabilities exploited in healthcare ransomware attacks?
- VPNs and remote access connections are common attack vectors due to misconfigurations and flaws in remote access products.
- Built-in administrator accounts and common credentials are often used to move laterally within networks.
- Lack of risk reassessments when products are updated leads to unaddressed vulnerabilities.
- Insufficient staff training and lack of cybersecurity policies leave employees unaware of potential threats.
What is the best defense against ransomware attacks?
- A robust data backup and recovery system is the most effective defense, ensuring quick restoration of data without paying a ransom.
- Backups should be secure, unaltered, and regularly tested to ensure they work when needed.
- Other defenses include conducting risk assessments, maintaining up-to-date security policies, and ensuring all stakeholders are trained in cybersecurity awareness.
How can healthcare organizations reduce the risk of ransomware attacks?
- Train employees: Conduct regular cybersecurity training to help staff recognize threat vectors and understand how to respond to potential attacks.
- Update risk assessments: Perform initial and ongoing risk assessments for all vendors and technologies, especially remote access tools.
- Automate processes: Use automation to streamline risk management and monitor vulnerabilities in real-time.
- Improve collaboration: Break down departmental silos to create a unified approach to risk management, involving IT, procurement, and compliance teams.
Why is training healthcare staff on cybersecurity important?
- A survey by Kaspersky revealed that 32% of healthcare workers have never received cybersecurity training, and 10% of managers are unaware of cybersecurity policies.
- Training empowers employees to recognize and report suspicious activity, reducing the likelihood of successful attacks.
- Awareness helps prevent human errors, such as clicking on phishing links or using weak passwords, which are common entry points for attackers.
How does risk assessment help combat ransomware?
- Risk assessments identify vulnerabilities in technologies, vendors, and processes that attackers could exploit.
- Regular re-assessments are essential as products and software updates may introduce new risks.
- Comprehensive assessments ensure healthcare organizations are 100% risk-aware, mitigating the chances of overlooked vulnerabilities.
What are the long-term benefits of improving ransomware defenses?
- Protects patient data'and ensures continuity of care, even during a cyberattack.
- Builds trust with stakeholders, including clinicians, patients, and the board, by demonstrating a commitment to cybersecurity.
- Improves efficiency and reduces costs by automating risk management tasks and preventing breaches.
- Enhances the organization’s overall cybersecurity posture, reducing vulnerabilities and ensuring regulatory compliance.
What is the ultimate goal for healthcare organizations in combatting ransomware?
- To adopt robust cybersecurity measures that protect data and patient care while enabling the safe adoption of new technologies.
- Foster a culture of risk awareness across the organization, ensuring all departments collaborate to identify and address potential threats.
- Implement automation and training to streamline processes, reduce manual tasks, and improve response times to cybersecurity incidents.
