Imminent Ransomware Attack Detected



The CISA, FBI and HHS have issued an alert ( regarding an imminent threat to hospitals and health care providers. Federal agencies have credible information to suggest that a widespread Ryuk ransomware attack is imminent. The malware may already be in place on networks and waiting to be activated by the threat actors. The threat actors are claiming that they are targeting 400 health care organizations with ransomware. The government is urging all health care providers to take precautions to protect their networks from this threat.

The ransomware is believed to be associated with and preceded with the deployment of Trickbot malware, so organizations should inspect their networks for presence of Trickbot. While Trickbot can be deployed on a network in a variety of ways, it is often copied as an executable file with a 12-character (including .exe), randomly generated file name in one of these directories:

  • C:\Windows\
  • C:\Windows\SysWOW64\
  • C:\Users\[Username]\AppData\Roaming\

The malware may also drop a file named anchorDiag.txt in one of these directories. Additional indicators of compromise (IOCs) can be found in the government’s alert (

Organizations that identify an IOC on their network are strongly recommended to contact Polsinelli and/or engage a computer forensic company through counsel immediately for assistance in containing the malware before the ransomware is launched.

Separately, the CISA, FBI and HHS recommend that health care providers take the following steps as quickly as possible:

Incident Response

  • Create hard copies of your organization’s incident response plan with contact information for key people and vendors;
  • Update antivirus and anti-malware solutions;
  • Establish and practice out of band, non VoIP, communications;
  • Rehearse IT lockdown protocol and process, including practicing backups.


  • Create offsite air gapped backups of critical systems and data assets following 3-2-1 practices;
  • Segment network as much as possible;
  • Limit/disable remote access/RDP ports and monitor remote access activity;
  • Enable multi-factor authentication for remote access
  • Audit active directory and audit logs to identify unauthorized accounts;
  • Audit administrative accounts for unauthorized activity;
  • Expedite patching response plan, especially for edge devices;
  • Scan for open or listening ports and close any that are unneeded;
  • Power down IT where not used/needed.

Business Continuity

  • Prepare to maintain continuity of operations if attacked;
  • Be prepared to reroute patients;
  • Ensure sufficient staffing to maintain continuity of operations with disrupted IT networks;
  • Retain backup hardware to rebuild systems as needed.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Polsinelli | Attorney Advertising

Written by:


Polsinelli on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.