No holiday pause for cyber adversaries warn government agencies

The Healthcare Cyber Communications Center, FBI, Cybersecurity & Infrastructure Security Agency and National Security Agency in December warned of new ransomware strains and other cyber threats targeting health care.  
  
•    The FBI and CISA warned of the “Cuba” Ransomware.  
•    HC3 warned of the Royal ransomware threat. 
•    HC3 warned that a new ransomware strain known as Blackcat was also targeting health care and appeared to be the successor of the notorious Russian speaking REvil ransomware gang. 
•    HC3 also warned of the latest version of the LockBit ransomware, known as LockBit 3.0. The LockBit “ransomware as service” in its various forms has targeted health care since 2019.  
•    The NSA advised of an advanced persistent threat known as APT5, which may be affiliated with the Chinese government, targeting the Citrix Application Delivery Controller which then provides the adversary broad network access.  
  
“Our cyber adversaries believe we may pause for the holidays, which may result in their increased targeting of hospitals and health systems as we have seen around past holidays,” said John Riggi, AHA national advisor for cybersecurity and risk. “But our hospitals never close and our network defenders never cease their vigilance. Increased vigilance is especially important currently as foreign cyber gangs and spies continue to test our resiliency through use of remote access tools, exploitation of technical vulnerabilities and use of new ransomware strains — all in an attempt to steal patient data and disrupt health care delivery, knowing that we are facing new waves of patients and our hospital beds are filling up. It is recommended that the technical remediation contained in the above alerts be implemented and that cyber incident response and emergency preparedness plans be integrated and prepared to execute if needed.”   
 
For more information on these or other cybersecurity and risk issues, contact Riggi at jriggi@aha.org.