Agencies release advisory on Iranian-backed cyber threat; House holds hearing on addressing ransomware threat

The FBI, Cybersecurity and Infrastructure Security Agency, Australian Cyber Security Centre, and United Kingdom’s National Cyber Security Centre today released an advisory highlighting ongoing malicious cyber activity by Iranian government-sponsored actors targeting U.S. critical infrastructure sectors, including health care. According to the advisory, the actors are focused on exploiting certain Fortinet and Microsoft Exchange vulnerabilities to access systems for follow-on operations such as data exfiltration or encryption, ransomware and extortion. The advisory describes observed tactics, indicators of compromise and recommended actions to reduce the risk of compromise. 

In other cyber news, the House Committee on Oversight and Reform yesterday held a hearing on strategies to address ransomware. Cybersecurity and Infrastructure Security Agency Executive Director Brandon Wales said countering risks to hospitals would be a “constant” focus for the agency in the years ahead. 

“There’s a lot more we need to do to make sure that hospitals are as protected as they need given the potential for disruptions there to have really significant consequences on both the communities as well as the patients," he told the committee.

John Riggi, AHA’s senior advisor for cybersecurity and risk, said, “We are pleased to see Executive Director Wales acknowledge that more can and must be done by the government to defend hospitals from foreign-based ransomware attacks. We have seen, almost weekly, how these attacks disrupt patient care across entire communities and threaten patient safety. As I stated in testimony before the Senate Homeland Security Committee last December, a ransomware attack on a hospital crosses the line from an economic crime to a threat to life crime, and we need the entire government to respond as such to aid the victims and pursue and disrupt the offenders overseas.” 

For more on this and other cyber and risk issues, contact Riggi at jriggi@aha.org.