A joint advisory issued Oct. 16 by the FBI, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and international agencies warn of a threat of Iranian cyber actors using brute force and other techniques to compromise organizations in health care and other critical infrastructure sectors. The actors are likely attempting to obtain credentials and information about the victim's network that could be sold to cybercriminals, the advisory said. Since Oct. 2023, these cyber actors have used forceful actions such as password spraying and multifactor authentication "push bombing" to compromise user accounts to gain access to organizations. Additionally, they frequently modified MFA registrations which enabled persistent access and performed discovery on compromised networks to obtain additional credentials and other information to potentially gain additional access points. 

“This alert emphasizes the ongoing threat to the U.S. health care sector, including hospitals, from Iranian cyber threat actors,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “Once these threat actors gain initial access to a system, they are selling that access to other threat actors who conduct much more sophisticated attacks, including ransomware attacks, often impacting the delivery of health care to patients and entire communities. Any ransomware attack which disrupts or delays patient care is a threat-to-life crime and the actors identified in this alert could be considered co-conspirators in these attacks. Hospitals should require the use of unique, complex passwords, which are changed regularly, and employ phishing-resistant multifactor authentication to help defend against these attacks. The voluntary Cybersecurity Performance Goals referenced in the alert, which the AHA helped to develop, are the best first line of defense against relatively unsophisticated initial access attacks like these. The AHA encourages hospitals to implement the CPGs to enhance their overall cybersecurity posture and help to thwart adversaries like these.” 

For more information on this or other cyber and risk issues contact Gee at sgee@aha.org. For the latest threat information and other cyber and risk resources visit www.aha.org/cybersecurity.

Related News Articles

Headline
The Food and Drug Administration yesterday released a safety notice announcing a software patch is available to address cybersecurity vulnerabilities in…
Headline
The Cybersecurity and Infrastructure Security Agency, FBI, Department of Defense Cyber Crime Center and the National Security Agency June 30 released a fact…
Headline
The Centers for Medicare & Medicaid Services today announced it has identified a fraud scheme targeting Medicare providers and suppliers. CMS said scammers…
Headline
The FBI, Cybersecurity and Infrastructure Security Agency and Australian Cyber Security Centre June 4 released an advisory on updated actions and tactics used…
Headline
The National Security Agency, Cybersecurity and Infrastructure Security Agency and international partners May 22 released guidance on securing data used for…
Headline
The FBI, along with the National Security Agency and other international cybersecurity agencies, this week released a joint agency advisory on cyber operations…