A joint advisory issued the week of July 8 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI and several international agencies warns of the threat of a state-sponsored cyber group in China. The Advanced Persistent Threat (APT) 40, also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk, has previously targeted organizations in the United States and other countries. APT40 is exploiting newly public vulnerabilities in widely used software such as Microsoft Exchanges, Log4J and Atlassian Confluence. The group appears to prefer exploiting public-facing infrastructure using techniques such as phishing campaigns and places a high priority on obtaining user credentials to enable a range of activities. 
  
"According to the authoring agencies, APT40 is operating on behalf of China’s Ministry of State Security," said John Riggi, AHA national advisor of cybersecurity and risk. "The report notes that this hacking group had previously been involved in the theft of medical research related to infectious diseases. This useful technical bulletin describes in detail how this group appears to prefer exploiting vulnerable, public-facing infrastructure over techniques that require user interaction, such as phishing campaigns, and places a high priority on obtaining valid credentials to enable a range of follow-on activities to enable penetration of high value networks and theft of sensitive data. Based upon this report, it is assessed that APT40 may pose a particular risk to health care organizations that have significant unpatched internet facing vulnerabilities and are engaged in sensitive medical research and innovation. Organizations fitting this risk profile should implement the report’s recommended mitigations."   
 
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.  

Related News Articles

Headline
A non-malicious global technology outage that began in the early morning of July 19 is continuing to affect many industries and is having varying effects on…
Headline
John Riggi, AHA’s national advisor for cybersecurity and risk, participated July 18 as the opening keynote speaker in the Information Security Media Group’s…
Headline
The AHA July 2 submitted comments to the Cybersecurity and Infrastructure Security Agency on its proposed rule establishing reporting requirements for…
Headline
The Department of Health and Human Services Health Sector Cybersecurity Coordination Center June 27 issued an alert about a critical vulnerability in MOVEit, a…
Headline
A joint report released June 26 by the Cybersecurity and Infrastructure Security Agency, FBI, the Australian Cyber Security Centre and Canadian Centre for…
Headline
The Health Information Sharing and Analysis Center June 27 issued a threat bulletin alerting the health sector to active cyberthreats exploiting TeamViewer. H-…