On October 28, 2020, the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), and the Cybersecurity and Infrastructure Security Agency (CISA) issued a Joint Cybersecurity Advisory regarding credible information of imminent cyber attacks to infect systems in the Healthcare and Public Health (HPH) sector with Ryuk ransomware.
Ransomware campaigns using the combination of tools described in the advisory include “dwell time” for the attacker ranging from four to six weeks. Dwell time is the amount of time an attacker spends undetected in a victim’s network environment.
The damage associated with previous campaigns includes:
- Encryption and ransom of vulnerable systems, including medical equipment that may have a significant impact on patient safety
- Disruption of care through denial of access to medical systems and records
- Exfiltration and extortion threats made around releasing electronic protected health information (ePHI) and personally identifiable information (PII)
- Secondary costs of regulatory reporting, investigation, remediation, notifications and litigation
Protiviti has issued a Flash Report summarizing the key findings in the Joint Advisory and offering guidance for organizations with regard to ransomware threats, long-term improvements to mitigate the threats, and specific advice to react to an attack underway or an early detection of one or more indicators of attack.
Read additional posts on The Protiviti View related to ransomware.
