Agencies recommend action to prevent compromise through routers, cloud environment
Russian state-sponsored cyber actors are using compromised Ubiquiti EdgeRouters to facilitate malicious cyber operations worldwide, the FBI and other agencies warned Feb. 27. In addition, the National Security Agency and other federal and international agencies Feb. 26 released an advisory to help organizations detect and defend against cyberattacks to the cloud environment by the APT29 group, a cyber-espionage group associated with Russian intelligence services.
“These alerts, which came in rapid succession, clearly demonstrate that the health care sector, like all critical infrastructure sectors, face cyberattacks not only from international criminal organizations, but from hostile foreign intelligence services,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “In one instance we have the Russian foreign intelligence services conducting highly sophisticated cyberattacks targeting mission-critical cloud-based services. The second alert describes the Russian military intelligence services conducting complex attacks against network EdgeRouters. The sophistication level and complexity of these cyber threats clearly demonstrate that cybersecurity requirements in a business associate agreement alone are insufficient leverage for hospitals and health systems to mitigate the unrelenting cyber risk exposure we face through third-party technology and service providers. A combination of secure-by-design principles strictly adhered to by software and technology developers, defensive measures and sustained offensive cyber operations by the government are needed to degrade the capabilities of our cyber adversaries. It is recommended that the mitigation practices outlined in these alerts be implemented as soon as feasible in combination with enhanced third-party risk management programs.”
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.