A joint advisory issued the week of July 8 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI and several international agencies warns of the threat of a state-sponsored cyber group in China. The Advanced Persistent Threat (APT) 40, also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk, has previously targeted organizations in the United States and other countries. APT40 is exploiting newly public vulnerabilities in widely used software such as Microsoft Exchanges, Log4J and Atlassian Confluence. The group appears to prefer exploiting public-facing infrastructure using techniques such as phishing campaigns and places a high priority on obtaining user credentials to enable a range of activities. 
  
"According to the authoring agencies, APT40 is operating on behalf of China’s Ministry of State Security," said John Riggi, AHA national advisor of cybersecurity and risk. "The report notes that this hacking group had previously been involved in the theft of medical research related to infectious diseases. This useful technical bulletin describes in detail how this group appears to prefer exploiting vulnerable, public-facing infrastructure over techniques that require user interaction, such as phishing campaigns, and places a high priority on obtaining valid credentials to enable a range of follow-on activities to enable penetration of high value networks and theft of sensitive data. Based upon this report, it is assessed that APT40 may pose a particular risk to health care organizations that have significant unpatched internet facing vulnerabilities and are engaged in sensitive medical research and innovation. Organizations fitting this risk profile should implement the report’s recommended mitigations."   
 
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.  

Related News Articles

Headline
The AHA is advising hospitals and health systems to be alert for potential scam calls where actors are impersonating Drug Enforcement Agency agents. An AHA…
Headline
The Cybersecurity and Infrastructure Security Agency and Food and Drug Administration Jan. 30 released notices warning of vulnerabilities found in the Contec…
Headline
The AHA yesterday released an advisory alerting members that the association and the Health Information Sharing and Analysis Center have identified attempted…
Headline
The ransomware attack last year against UnitedHealth Group subsidiary Change Healthcare exposed data of more than 190 million people — up from previous reports…
Headline
The Cybersecurity and Infrastructure Security Agency and FBI Jan. 22 released an advisory explaining how cyberthreat actors “chained” vulnerabilities —…
Headline
A guide published Jan. 13 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI, Environmental Protection Agency,…