Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

8/21/2019
01:00 PM
100%
0%

State-Sponsored Cyberattacks Target Medical Research

Cancer research is a particular target among Chinese espionage groups, says security firm FireEye.

Online attackers from Russia, Vietnam, and especially China are targeting healthcare data and stealing intellectual property from hospitals, pharmaceutical companies, and research universities, according to a new report published today by security firm FireEye. 

While cybercriminals continue to be the most prolific attackers, many of the most significant attacks appear to be intelligence operations aimed at stealing research or gathering information on specific individuals, states the "Beyond Compliance: Cyber Threats and Healthcare" report. In particular, Chinese espionage groups appear to be focused on procuring cancer-related research, which the company argues is driven by increasing cancer mortality in China and the associated costs.

"There is not just one group focused on this, but multiple Chinese groups conducting these operations," says Luke McNamara, principal intelligence analyst at FireEye. "Cancer is one of the leading causes of death in China, and there is a big focus on improving cancer treatments on the part of their pharmaceutical industry."

The report collects both FireEye's internal research and open source intelligence on threats. The company found the most frequent threat is that of opportunistic cybercriminals compromising systems and and destructive attacks, such as ransomware.

In the last quarter of 2018 and the first quarter of 2019, the company found multiple databases from healthcare organizations on sale on online black market forums. For example, a 4.31-gigabyte file of healthcare records from a US organizations, including patient data, driver's licenses, and insurance information, was being sold for $2,000. Personally identifiable information (PII) and protected health information (PHI) are often used to conduct fraud or to craft more focused attacks.

"Actors buying and selling PII and PHI from healthcare institutions and providers in underground marketplaces is very common, and will almost certainly remain so due to this data's utility in a wide variety of malicious activity ranging from identity theft and financial fraud to crafting of bespoke phishing lures," the report states.

The healthcare industry is a popular target for online criminals and nation-state operators. In June, a number of medical-testing service providers, such as LabCorp and Quest Diagnostics, announced a breach of their collections-service partner, American Medical Collection Agency, resulted in almost 20 million patient records being stolen.

Yet attackers are also focusing heavily on research data, including information on research participants and pharmaceutical and biomedical intellectual property, FireEye's McNamara says. The purpose of the attacks likely falls into "two buckets," he says. 

"Some are focused on entities that have access to large data sets — those attacks are about getting large-scale data collection in furtherance of intelligence operations and finding specific people," McNamara says. "Then there is the targeting of medical researchers by Chinese espionage groups. You see it going across multiple APT groups going back many years."

The second category of cyber operations is particularly focused on cancer research, according to FireEye's report. In April, a China-linked espionage group attacked a US-based health center focused on cancer research, attempting to lure researchers into clicking on a document that referenced a research conference. 

Such attacks are not uncommon. One Chinese espionage group, APT22, targeted the same institution for many years. An advanced persistent threat (APT) group is the industry term for sophisticated attackers that specifically target certain companies, organizations, or agencies. 

Another Chineses group, APT41, targeted biotech companies and the medical subsidiary of a large corporation, FireEye stated. 

China is not the only actor targeting biomedical research. At least two Russian APT groups and a Vietnam-based group have conducted operations that have either targeted healthcare organizations or had a focus on the biological sciences. For example, one group — APT 28, sometimes called "Fancy Bear" — attacked the World Anti-Doping Association (WADA), which tests Olympic athletes for use of banned drugs and supplements.

The report also underscores the threat posed by attacks that aim to have a cyber-physical impact, such as ransomware that attempts to halt operations or the targeting of medical devices to harm patients.

"Looking forward, the increasing number of biomedical devices used for critical functions within hospitals and healthcare providers presents a growing security challenge," the report concluded. "Furthermore — given their importance and value — a growing willingness by cyber crime, or, in a period of heightened geopolitical tensions, nation state actors — to deploy disruptive and destructive tools may significantly increase the impact from these threats we have observed to date."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

 

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4147
PUBLISHED: 2019-09-16
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVE-2019-5481
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2019-5482
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-15741
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVE-2019-16370
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.