The CISA, FBI and HHS have issued an alert (https://us-cert.cisa.gov/ncas/alerts/aa20-302a) regarding an imminent threat to hospitals and health care providers. Federal agencies have credible information to suggest that a widespread Ryuk ransomware attack is imminent. The malware may already be in place on networks and waiting to be activated by the threat actors. The threat actors are claiming that they are targeting 400 health care organizations with ransomware. The government is urging all health care providers to take precautions to protect their networks from this threat.

The ransomware is believed to be associated with and preceded with the deployment of Trickbot malware, so organizations should inspect their networks for presence of Trickbot. While Trickbot can be deployed on a network in a variety of ways, it is often copied as an executable file with a 12-character (including .exe), randomly generated file name in one of these directories:

• C:\Windows\
• C:\Windows\SysWOW64\
• C:\Users\[Username]\AppData\Roaming\

The malware may also drop a file named anchorDiag.txt in one of these directories. Additional indicators of compromise (IOCs) can be found in the government’s alert (https://us-cert.cisa.gov/ncas/alerts/aa20-302a).

Organizations that identify an IOC on their network are strongly recommended to contact Polsinelli and/or engage a computer forensic company through counsel immediately for assistance in containing the malware before the ransomware is launched.

Separately, the CISA, FBI and HHS recommend that health care providers take the following steps as quickly as possible:

Incident Response

• Create hard copies of your organization’s incident response plan with contact information for key people and vendors;
• Update antivirus and anti-malware solutions;
• Establish and practice out of band, non VoIP, communications;
• Rehearse IT lockdown protocol and process, including practicing backups.

Technical

• Create offsite air gapped backups of critical systems and data assets following 3-2-1 practices;
• Segment network as much as possible;
• Limit/disable remote access/RDP ports and monitor remote access activity;
• Enable multi-factor authentication for remote access
• Audit active directory and audit logs to identify unauthorized accounts;
• Audit administrative accounts for unauthorized activity;
• Expedite patching response plan, especially for edge devices;
• Scan for open or listening ports and close any that are unneeded;
• Power down IT where not used/needed.

Business Continuity

• Prepare to maintain continuity of operations if attacked;
• Be prepared to reroute patients;
• Ensure sufficient staffing to maintain continuity of operations with disrupted IT networks;
• Retain backup hardware to rebuild systems as needed.