The Cybersecurity and Infrastructure Security Agency Oct. 31 issued an alert on a large-scale spear-phishing campaign targeting organizations in several sectors. The agency received multiple reports on the matter. According to the agency, the foreign threat actor, often posing as a trusted entity, sends spear-phishing emails with malicious remote desktop protocol files to targeted organizations to connect to and access files stored on the target’s network. If the threat actor gains access, it could perform additional activities, such as deploying malicious code to achieve persistent access to the target’s network. CISA, other federal agencies and partners are coordinating and assessing the impact of the campaign and urged organizations to take proactive measures to protect their data and systems. 

"The malicious use of RDP to conduct cyberattacks, including highly disruptive ransomware attacks, continues to be a significant attack vector used by foreign cybercriminals, ransomware gangs and spies," said John Riggi, AHA national advisor for cybersecurity and risk. "To help mitigate this type of cyberattack risk, it is strongly recommended health care organizations restrict outbound RDP connections, block RDP connections in communication platforms, prevent execution of RDP files and use phishing-resistant multi-factor authentication for all remote access. Please review the alert for additional recommendations." 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.

Related News Articles

Headline
A Health-ISAC (Information Sharing and Analysis Center) bulletin released Oct. 1 warns of a recently released LockBit 5.0 ransomware variant that poses a…
Headline
Fernando Martinez, Ph.D., chief digital officer at the Texas Hospital Association, shares how Texas and the THA are building regional resilience through cyber…
Headline
The federal government shut down Oct. 1 following a failed Senate vote on the House-passed continuing resolution to fund the government by midnight Sept. 30.…
Headline
Microsoft Sept. 16 announced it had disrupted a growing phishing service that had targeted at least 20 U.S. health care organizations. The company said it used…
Headline
The FBI Sept. 12 released an alert warning of malicious activities by cybercriminal groups UNC6040 and UNC6395, which the agency said are responsible for an…
Headline
The Cybersecurity and Infrastructure Security Agency, National Security Agency and international agencies Sept. 3 released joint guidance outlining a “software…