A wave of ransomware hits US hospitals as coronavirus spikes

American hospitals are being targeted in a wave of ransomware attacks as covid-19 infections in the US break records and push the country’s health infrastructure to the brink. As reports emerge of attacks that interrupted healthcare in at least six US hospitals, experts and government officials say they expect the impact to worsen—and warn that the attacks could potentially threaten patients’ lives.

“I think we’re at the beginning of this story,” said Mike Murray, CEO at the healthcare security firm Scope Security. “These guys are moving very fast and very aggressively. These folks seem to be trying to collect as much money as possible very quickly. I think it will be tomorrow or over the weekend before the real scale of this is understood. Compromises are still ongoing.”

The Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, and Department of Health and Human Services published a dramatic warning on the night of Wednesday, October 28 about “imminent” ransomware threats to American hospitals. The agencies held a conference call with healthcare security executives earlier that day to emphasize the need to prioritize this threat. Ransomware is a type of hack in which an attacker uses malware to hijack a victim’s system and demand payment in order to hand back control.

Hospitals including St. Lawrence Health System in New York, Sonoma Valley Hospital in California, and Sky Lakes Medical Center in Oregon have all said they’ve been hit by ransomware. One doctor told Reuters that an impacted hospital had to function entirely on paper after their computers were taken offline.

These attacks and ransomware’s growth to a multibillion-dollar international industry raise grim questions: Is there any way to stop the ransomware threat? The problem has grown exponentially over the last decade and the pandemic has only increased profits for ransomware gangs.

One answer could be for the US government to carry out more offensive hacking operations against ransomware gangs, similar to one which US Cyber Command conducted earlier this month. But today’s attacks prove that definitively disrupting ransomware gangs is easier said than done.

The infamous ransomware gang behind these new attacks is known primarily as UNC1878 or Wizard Spider. The group, believed to be operating out of Eastern Europe, has been tracked for at least two years across hundreds of targets. 

“They’re incredibly prolific,” said Allan Liska, an intelligence analyst at the cybersecurity firm Recorded Future. “Their infrastructure is very good, you can see that because even with the takedowns Microsoft and Cyber Command have tried they’re still able to operate. Honestly, they’re better funded and more skilled than many nation-state actors.”

The hacking tools the UNC1878 uses include the notorious TrickBot trojan to gain access to victims’ systems, and the Ryuk ransomware to extort victims. Several of the tools in the group’s arsenal check and spare targeted machines if the systems are operating in Russian or, sometimes, in other languages used in post-Soviet nations. 

The number of ransomware attacks against American hospitals has risen 71% in October 2020 compared to September, according to the cybersecurity firm Check Point. The rest of the world has seen smaller but significant spikes in activity. Ryuk is responsible for 75% of ransomware attacks against American healthcare organizations.

A patient died in September when ransomware hit a German hospital but that attack appears to have targeted a hospital by mistake. By stark contrast, this week’s attacks are intentional.