Reducing the Risk of Advanced Ransomware – Ryuk family

On October 28, 2020, the CISA, the FBI, and HHS released an advisory noting potentially hundreds of medical centers and hospitals would be targeted for ransomware encryption.

Although ransomware has been a serious threat for the past five years, the risk of an operational outage or a breach is ever expanding.

Ransomware has evolved over the last 5 years increasing its impact and ability to crush hospital systems. 2015 was the year of ransomware with the emergence of CryptoWall. The attack began with phishing to gain initial access to an endpoint. It would encrypt the drive and present the user with ransomware instructions. The machine then joined a botnet to spread the malware, repeating the phishing cycle. Individual computers were then targeted.  Large companies including hospitals fell victim, but it was rare for hospitals systems to be targeted.

The next large evolution in ransomware occurred in 2017. A group of exploits (EternalBlue) allowed for remote compromise of Windows devices. Ransomware kits began to add EternalBlue vulnerabilities. This allowed for programmatic compromise of large networks lacking mature patch management. Hospitals were now seen as an easy target.

The latest evolution in ransomware is the incorporation of techniques once reserved for nation states. One of the latest groups to receive notoriety is UNC1878 or 2020 Wizard Spider. By combining phishing, credential harvesting, privilege escalation, data exfiltration, and ransomware, the threat is a worst-case scenario for a medical system. The impact is both a large continued operational outage and a potential breach scenario. By combining automation with human interaction, the malware can be spread quickly across systems. Re-imaging an endpoint can be ineffective as compromised credentials allow for quick reinfection and encryption. Even more devastating, attackers can exfiltrate and hold sensitive regulatory data hostage.

Prior to this attack, fending off ransomware included security awareness, email filtering, patching, and worst-case, restoration of data. But now because an attack can incorporate privilege escalation and lateral movement, the security department must also evaluate local administrative privileges, password entropy, service accounts with authority, domain administrator accounts, insecure protocols, and methods to identify the exfiltration of data. Attackers understand it can take years and massive capital to deprecate programs, service accounts, and protocols that a company has operationally relied on for years. When you consider expensive biomedical devices such as MRI machines, it is easy to understand why hospitals are targeted. In addition, the security department must have the visibility and training to detect lateral movement including log aggregation and correlation. That can be a specialized skillset.

If you are a medical facility or a hospital, where do you get started?

1. Multi-factor Authentication – MFA is essential to protecting against compromised domains
2. Backups – Although restoring data is the last line of defense, once encrypted it is the only option
   1. For workstations, consider using a cloud service with versioning control (e.g.,OneDrive)
   2. For servers, ensure back-ups are routine and protected from being corrupted and/or deleted by threat actors
3. Routine Patching – Although credential theft can be successfully executed on a fully patched network, exploited vulnerabilities can lead to the same outcome. Patching alone will prevent ransomware.
   1. Remove end-of-life devices
4. Identify and Filter Phishing Emails
5. Security Awareness
   1. Routine training
   2. Phishing Simulations – Disciplinary action for repeated failures
   3. Centralized reporting for a suspected phishing attempt
6. Enforce the Disablement of Macros – Macros are often utilized to gain an initial foothold in the environment.
7. Log Aggregation – Logging data to a safe place is essential to be able to perform detection. Log aggregation is an extensive project.
   1. Network logging
   2. Security events for both workstations and servers
   3. Power Shell logging
   4. Sysmon logging
8. Developing an Incident Playbook – Once you have logging, the security teams should begin building alerts, metrics, dashboards, and playbooks for both detecting and responding to malicious behaviors.
9. Routine Attack and Penetration Testing & Tabletop Exercises
10. Limiting Domain Admins – A compromised domain administrator will lead to a compromised domain controller. Once compromised, all workstations, servers, trusts, and users are compromised.
    1. Utilizing password vaults with rotating passwords can help limit exposure.
11. User Account Passwords
    1. Increasing password complexity can help to remove common and/or easy to crack passwords from the environment
    2. Using password vaults can also abstract users from knowing their password
    3. Implement Windows Hello with pin codes or biometrics
12. Service Account Passwords - Service accounts’ passwords must be long and difficult to crack.
    1. Service account passwords must be long and difficult to crack
    2. Managed Service Accounts- Managed service accounts utilize Windows to create a unique and programmatically rotated password
13. Remove Administrative Rights from Endpoints – Removing administrative rights increases the complexity and steps required fora threat actor to execute powerful attack tools to harvest elevated credentials.
14. Network Segmentation – By applying firewalls and other segmentation controls, zones can be defined to inspect traffic. Conceptually, this is like a border between nations.
15. Deprecate older protocols such as SMB v1and RC4 from the environment.

Want to learn more about how MEDHOST protects its systems and customers utilizing its solutions with enhanced security measures, reach out to us inquiries@medhost.com or 1.800.383.6278