Feds Warn of Evil Corp Threats Facing Healthcare Sector

guest · Sep 3, 2022

HHS HC3: Russian Cybercrime Gang Has History, Powerful Malware, Ties to Other Gangs
By Marianne Kolbasuk McGee @healthinfosec - August 30, 2022

Federal authorities are sounding the alarm for the healthcare industry over Russian cybercrime gang Evil Corp, warning that the group has a wide set of highly capable tools at its disposal for taking healthcare data hostage.

The Department of Health and Human Services' Health Sector Cybersecurity Coordination Center in a threat advisory warns the healthcare sector that the gang, best known for developing Dridex malware, "has been exceptionally aggressive and capable in their more than decade of global hacking operations."
Click to expand...

Many Evil Corp-related groups and malware variants have targeted the health sector aggressively. "Ransomware is one of their primary modus operandis as they have developed and maintained many strains," HHS HC3 writes. Many ransomware operators have found the health sector to be an enticing target since medical practitioners often prefer paying a ransom over disrupting patient care.

Healthcare sector organizations are also particularly susceptible to patient data theft for sale by cybercriminals on the dark web, HHS HC3 says.
Click to expand...

Also, "foreign governments often find it to be more cost-effective to steal research and intellectual property via data exfiltration cyberattacks rather than invest time and money into conducting research themselves. This includes intellectual property related to the health sector."

"It is entirely plausible that Evil Corp could be tasked with acquiring intellectual property from the U.S. health sector using such means at the behest of the Russian government," the advisory says.
Click to expand...

In addition to its in-house-coded Dridex multipurpose malware, Evil Corp also has access to prolific malware variants such as Trickbot and Emotet, as well as major ransomware operations such as Ryuk.

One of Evil Corp.'s most notable healthcare sector attacks was a ransomware assault on NHS Lanarkshire - part of Britain's National Health Service - which affected several Scottish hospitals in 2017, HHS HC3 says (see: Scottish Hospitals Hit by Bitpaymer Ransomware).
Click to expand...

HHS HC3 - Threat advisory - Evil Corp
(PDF): https://www.hhs.gov/sites/default/files/evil-corp-threat-profile.pdf

HC3 Threat Profile: Evil Corp
August 29, 2022 TLP: White Report: 202208291500
Threat Profile: Evil Corp (AKA UNC2165)
Executive Summary
Evil Corp (AKA UNC2165) is a one of the most capable cybercriminal syndicates in the world. They are based out of Russia and have been operational since 2009. They are responsible for the development and operations of several of the most powerful malware and ransomware variants, and maintain strong relationships not just with other powerful cybercriminal gangs, but also the Russian government. The U.S. federal government has indicted members of their gang and has an active bounty offered for information on their leadership. Evil Corp has been observed modifying their activities to circumvent U.S. federal government actions to stop them.
Click to expand...

Log in or Sign up

Feds Warn of Evil Corp Threats Facing Healthcare Sector

guest Guest

Log in or Sign up

Feds Warn of Evil Corp Threats Facing Healthcare Sector

guest Guest

Useful Searches