The FBI, State Department and National Security Agency issued a warning about attempts by North Korean state-sponsored cyberthreat actors to exploit improperly configured domain-based message authentication, reporting and conformance record policies to conceal social engineering attempts. Without properly configured DMARC policies, malicious cyber actors are able to send spoofed emails as if they came from a legitimate domain’s email exchange, the advisory states. The cyber actors have conducted spear phishing campaigns posing as journalists, academics or other experts in East Asian affairs with credible links to North Korean policy circles.

“Beyond the threat from North Korea, we have seen all types of nefarious cyber actors exploit improperly configured domain-based message authentication to send hospitals and health systems ‘spoofed’ phishing emails,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “This alert serves as a good reminder to ensure this basic cybersecurity protocol is properly configured to ensure that when the bad guys send staff or our contacts an email that appears to be from (someone known)@(your organization).org it will fail the validation test of DMARC and flagged as suspicious  (someone unknown)@(unknown organization).org. Stay vigilant and up to date on basic cybersecurity protocols and ensure phishing email tests and cyber education continue with staff, as our criminal and nation state adversaries are becoming increasingly aggressive and creative in their social engineering techniques.”

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.

Related News Articles

Headline
The Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) this week released an advisory about Qilin, formerly "Agenda…
Headline
Change Healthcare June 20 began notifying health care providers and other customers with patient data stolen following February’s cyberattack, the company…
Headline
The Centers for Medicare & Medicaid Services June 17 announced it will close its accelerated and advance payment program July 12 for Medicare providers and…
Headline
The health care sector should swiftly implement patches or mitigations to address 14 new cyber vulnerabilities identified by the Cybersecurity and…
Headline
The Departments of Health and Human Services, Labor, and the Treasury June 14 announced a 120-day extension for parties impacted by the cyberattack on Change…
Headline
Microsoft and Google will provide a range of free or discounted cybersecurity services to rural hospitals across the country to help them in their efforts to…