A Patient Dies After Ransomware Attack Paralyzes German Hospital Systems

The incident marks the first recorded casualty as a consequence
of cyberattacks on critical healthcare facilities, which has ramped
up in recent months.

The attack, which exploited a Citrix ADC CVE-2019-19781^[2] vulnerability to
cripple the hospital systems on September 10, is said to have been
“misdirected” in that it was originally intended for Heinrich Heine
University, according to an extortion note left by the
perpetrators.

After law enforcement contacted the threat actors and informed
them that they had encrypted a hospital, the operators behind the
attack withdrew the ransom demand and provided the decryption
key.

The case is currently being treated as a homicide, BBC
News reported^[3] over the
weekend.

Unpatched Vulnerabilities Become Gateway to Ransomware
Attacks

Although several ransomware gangs said early on in the pandemic
that they would not deliberately target hospitals or
medical facilities^[4], the recurring
attacks prompted the
Interpol^[5] to issue a warning
cautioning hospitals against ransomware attacks designed to lock
them out of their critical systems in an attempt to extort
payments.

Weak credentials and VPN vulnerabilities have proven to be a
blessing in disguise for threat actors to break into the internal
networks of businesses and organizations, leading cybersecurity
agencies in the U.S. and U.K. to publish multiple^[6] advisories^[7] about active
exploitation of the flaws.

“The [Federal Office for Information Security] is becoming
increasingly aware of incidents in which Citrix systems were
compromised before the security updates that were made available in
January 2020 were installed,” the German cybersecurity
agency said^[8] in an alert last
week.

“This means that attackers still have access to the system and
the networks behind it even after the security gap has been closed.
This possibility is currently increasingly being used to carry out
attacks on affected organizations.”

The development also coincides with a fresh advisory^[9] from the U.K.
National Cyber Security Centre (NCSC), which said it’s observed an
uptick in ransomware incidents targeting educational institutions
at least since August 2020, while urging schools and universities
to implement a “defence in depth” strategy to defend against such
malware attacks.

Some of the affected institutions included Newcastle^[10] and Northumbria^[11] Universities,
among others.

Citing Remote Desktop Protocol (RDP), vulnerable software or
hardware, and email phishing as the three most common infection
vectors, the agency recommended^[12] organizations to
maintain up-to-date offline backups, adopt endpoint malware
protection, secure RDP services using multi-factor authentication,
and have an effective patch management strategy in place.

A Spike in Ransomware Infections

If anything, the ransomware crisis seems to be only getting
worse. Historical data^[13] gathered by Temple
University’s CARE cybersecurity lab has shown that there have been
a total of 687 publicly disclosed cases in the U.S. since 2013,
with 2019 and 2020 alone accounting for more than half of all
reported incidents (440).

Government facilities, educational institutions, and healthcare
organizations are the most frequently hit sectors, as per the
analysis.

And if 2020 is any indication, attacks against colleges and
universities are showing no signs of slowing down.

Allan Liska, a threat intelligence analyst at Recorded Future,
revealed there had been at least 80 publicly reported ransomware
infections targeting the education sector to date this year, a
massive jump from 43 ransomware attacks for the whole of 2019.

“Part of this change can be attributed to extortion sites, which
force more victims to announce attacks,” Liska said in
a tweet^[14]. “But, in general,
ransomware actors have more interest in going after colleges and
universities, and they are often easy targets.”

You can read more about NCSC’s mitigation measures here^[15]. For more guidance on
proofing businesses against ransomware attacks, head to US
Cybersecurity Security and Infrastructure Security Agency’s
response guide here^[16].