December 4, 2020

Volume X, Number 339

Advertisement

December 03, 2020

Subscribe to Latest Legal News and Analysis

December 02, 2020

Subscribe to Latest Legal News and Analysis

December 01, 2020

Subscribe to Latest Legal News and Analysis

Imminent Ransomware Attack Detected

The CISA, FBI and HHS have issued an alert (https://us-cert.cisa.gov/ncas/alerts/aa20-302a) regarding an imminent threat to hospitals and health care providers. Federal agencies have credible information to suggest that a widespread Ryuk ransomware attack is imminent. The malware may already be in place on networks and waiting to be activated by the threat actors. The threat actors are claiming that they are targeting 400 health care organizations with ransomware. The government is urging all health care providers to take precautions to protect their networks from this threat.

The ransomware is believed to be associated with and preceded with the deployment of Trickbot malware, so organizations should inspect their networks for presence of Trickbot. While Trickbot can be deployed on a network in a variety of ways, it is often copied as an executable file with a 12-character (including .exe), randomly generated file name in one of these directories:

  • C:\Windows\

  • C:\Windows\SysWOW64\

  • C:\Users\[Username]\AppData\Roaming\

The malware may also drop a file named anchorDiag.txt in one of these directories. Additional indicators of compromise (IOCs) can be found in the government’s alert (https://us-cert.cisa.gov/ncas/alerts/aa20-302a).

Organizations that identify an IOC on their network are strongly recommended to contact Polsinelli and/or engage a computer forensic company through counsel immediately for assistance in containing the malware before the ransomware is launched.

Separately, the CISA, FBI and HHS recommend that health care providers take the following steps as quickly as possible:

Incident Response

  • Create hard copies of your organization’s incident response plan with contact information for key people and vendors;

  • Update antivirus and anti-malware solutions;

  • Establish and practice out of band, non VoIP, communications;

  • Rehearse IT lockdown protocol and process, including practicing backups.

Technical

  • Create offsite air gapped backups of critical systems and data assets following 3-2-1 practices;

  • Segment network as much as possible;

  • Limit/disable remote access/RDP ports and monitor remote access activity;

  • Enable multi-factor authentication for remote access

  • Audit active directory and audit logs to identify unauthorized accounts;

  • Audit administrative accounts for unauthorized activity;

  • Expedite patching response plan, especially for edge devices;

  • Scan for open or listening ports and close any that are unneeded;

  • Power down IT where not used/needed.

Business Continuity

  • Prepare to maintain continuity of operations if attacked;

  • Be prepared to reroute patients;

  • Ensure sufficient staffing to maintain continuity of operations with disrupted IT networks;

  • Retain backup hardware to rebuild systems as needed.

© Polsinelli PC, Polsinelli LLP in CaliforniaNational Law Review, Volume X, Number 303
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

 Iliana L. Peters Data Privacy Shareholder Polsinelli Law Firm
Shareholder

Iliana L. Peters believes good data privacy and security is fundamental to ensuring patients’ trust in the health care system, and to helping health care clients succeed in an ever-changing landscape of threats to data security. She is recognized by the health care industry as a preeminent thinker and speaker on data privacy and security, particularly with regard to HIPAA, the HITECH Act, the 21st Century Cures Act, the Genetic Information Nondiscrimination Act (GINA), the Privacy Act, and emerging cyber threats to health data.

For over a decade...

202.626.8327
Bruce A. Radke Data Privacy Attorney Polsinelli Chicago, IL
Shareholder

Bruce A. Radke is a Shareholder and a member of the Tech Transactions & Data Privacy practice.  Bruce is Co-Chair of the firm's Privacy and Cybersecurity practice group.  He has been selected by his peers as a Leading Lawyer in Data Privacy and Computer & Technology Law.

Bruce regularly counsels clients on various privacy and data security issues. He has drafted and reviewed data privacy and security policies and procedures to ensure compliance with HIPAA, HITECH, COPPA, GLBA, Payment Card Industry (PCI) Data Security Standards, state breach notification laws,...

312-463-6211
Michael Waters Polsinelli litigation lawyer
Shareholder

Michael Waters is an experienced litigator and member of the Tech Transactions & Data Privacy practice.  He handled one of the first data breach matters shortly after California passed its breach notification law in 2003 and has since counseled clients across industries through nearly every conceivable type of breach, from system-wide network intrusions and ransomware attacks to situations involving cyber extortion, stolen laptops and computer hardware, email compromises, wire fraud and employee wrongdoing.

Michael regularly assists companies in investigations...

312.463.6212
Pavel Pasha Sternberg Data Privacy Attorney
Associate

Pavel (Pasha) A. Sternberg is an associate in the Tech Transactions & Data Privacy practice. Pasha regularly advises clients of all sizes, and across industry segments, on domestic and international privacy and cybersecurity regulations. Pasha works to help clients implement compliance and remediation efforts to comply with these laws, as well as to investigate and respond to cyber incidents. Pasha began his career in-house helping to develop and manage a full-scale privacy program at a large healthcare entity, and so is familiar with the realities of managing a compliance program in a...

415.248.2129
Advertisement
Advertisement