Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Microsoft Alerts Healthcare to Human-Operated Ransomware

Microsoft has notified dozens of hospitals with vulnerable gateway and VPN appliances in their infrastructure, which could put them at risk.

Microsoft is alerting healthcare organizations to a rise in human-operated ransomware, which has been growing in frequency as attackers continue to take advantage of the COVID-19 crisis.

These types of ransomware campaigns typically seek easy entry into target businesses, many of which have transitioned to remote workforces to stop the coronavirus spread. As a result, ransomware operators have begun to target network devices such as gateway and VPN appliances. The healthcare sector is especially vulnerable to these types of attacks, Microsoft reports, and it has identified and alerted "several dozens of hospitals" with vulnerable gateway and VPN tools.

Microsoft's Threat Protection Intelligence Team and Threat Intelligence Center report more human-operated ransomware campaigns are exploiting vulnerabilities in network devices to gain a foothold in target organizations. REvil, also known as Sodinokibi, is an example of one campaign doing this. Once on a network, its operators aim to steal credentials, elevate their privileges, and move laterally across a network before installing ransomware or other malware.

Data shows an overlap between infrastructure Sodinokibi used last year and infrastructure it used in recent VPN attacks. "This indicates an ongoing trend among attackers to repurpose old tactics, techniques, and procedures (TTPs) for new attacks that take advantage of the current crisis," Microsoft explains in a blog post. While team members haven't seen technical changes, they did notice social engineering techniques designed to exploit people's fears surrounding COVID-19.

Their methods are meant to target institutions like healthcare organizations, which may not have had time or resources to strengthen their security posture by installing new patches, updating firewalls, or checking employees' privileges. To help them address these vulnerabilities, Microsoft explained to hospitals in its notification how attackers can break in and advised them how to apply security patches that could protect them from this threat.

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Untangling Third-Party Risk (and Fourth, and Fifth...)."

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
futurocoches
50%
50%
futurocoches,
User Rank: Apprentice
4/3/2020 | 3:53:17 PM
covid
how covid has changed the rules...
tdsan
50%
50%
tdsan,
User Rank: Ninja
4/2/2020 | 7:10:10 AM
This has been going on for years
Health-care organizations have been behind the IT curve or cybersecurity curve for years. They have products that test individuals that are running Windows 7 and XP. They also have Wireless security devices that are connected to open internet connections. Again, not all organizations but people oftentimes do not pay attention to the details and with large organizations like this, they can be easily overlooked.

T
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/3/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4177
PUBLISHED: 2020-06-03
IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174732.
CVE-2020-4180
PUBLISHED: 2020-06-03
IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 174735.
CVE-2020-4182
PUBLISHED: 2020-06-03
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174738.
CVE-2020-4187
PUBLISHED: 2020-06-03
IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174805.
CVE-2020-4190
PUBLISHED: 2020-06-03
IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174851.