Cybersecurity Blog
Thought leadership. Threat analysis. Cybersecurity news and alerts.
New Variant of SamSam Ransomware Targets Health Sector
Since the beginning of 2018, several organizations in the health sector have publicly acknowledged that they’ve been hit by the new variant of the ransomware called “SamSam”.
Cloud-based electronic health records (EHR) provider Allscripts, Hancock Health Hospital in Greenfield, Indiana; and Adams Memorial Hospital in Decatur, Indiana acknowledged that they’ve been a target by the new variant of SamSam ransomware. Only Hancock Health Hospital admitted that it paid ransom money to the SamSam attackers. The hospital paid the attackers 4 Bitcoins (approximately $55,000 at the time). “The hospital’s leadership, upon consideration of many factors, made the determination to pay the ransom of four bitcoin demanded by the attackers, in order to retrieve the private encryption keys,” Hancock Health CEO Steve Long said in a statement. “We were in a very precarious situation at the time of the attack. With the ice and snow storm at hand, coupled with the one of the worst flu seasons in memory, we wanted to recover our systems in the quickest way possible and avoid extending the burden toward other hospitals of diverting patients. Restoring from backup was considered, though we made the deliberate decision to pay the ransom to expedite our return to full operations.” What is SamSam Ransomware?
SamSam, also known as Samas or Samsa, is a malicious software (malware) that’s categorized as a ransomware. Like other ransomware it encrypts files, locks out users from using their computers and from accessing files, and demands ransom payment in the form of Bitcoin to unlock the encrypted files.
Below is a sample of the ransom note of the new SamSam variant prominently displayed on the infected computer. 
Image by Cisco
The original version of SamSam ransomware uses JexBoss, a tool that scours the internet for unpatched servers running Red Hat’s JBoss enterprise products. Once attackers gain entry via an unpatched server, they then use other open-sourced tools to collect information on networked computers. This open-sourced tools include the use of widely-used, weak and reuse passwords.
Once a computer is infected with SamSam ransomware, this malware proceeds to encrypt files and then demand a ransom. Once the server is infected by SamSam, all the other computers connected to the server are infected as well by the ransomware. The first SamSam ransomware attack was first observed on March 2, 2016. On March 31, 2016, the United States Department of Homeland Security (DHS), in collaboration with Canadian Cyber Incident Response Centre (CCIRC) issued a joint security alert warning about the dangers of ransomware, including SamSam or Samas. "In early 2016, destructive ransomware variants such as … Samas were observed infecting computers belonging to individuals and businesses, which included healthcare facilities and hospitals worldwide,” said DHS and CCIRC. According to Symantec, what sets the original SamSam ransomware from other ransomware is the way this malware reaches its intended targets via unpatched server-side software. “The big takeaway here is the growing trend that criminals are directly targeting organizations in ransomware attacks,” Symantec said. “The success of these recent attacks signals a shift for cybercriminals as they seek to maximize profits by setting their sights on vulnerable businesses.” Attackers using the older version of Samsam ransomware initially asked a payment option of 1 Bitcoin for each PC that has been infected. The ransom payment demand later went up to 1.5 Bitcoin and 1.7 Bitcoin. According to security researchers at Cisco, as of March 23, 2016, SamSam victims paid nearly 275 Bitcoins (approximately $115,000 as one Bitcoin at the time costs $418). Cisco researchers said that one Bitcoin wallet used by attackers to receive ransom payment for the new SamSam ransomware variant started receiving payments since December 25, 2018 and received 26 Bitcoins, valued nearly $300,000 as of January 19, 2018. According to Cisco, there’s a possibility that compromised Remote Desktop Protocol (RDP) servers have played a role in allowing the attackers of the new SamSam variant to obtain an initial foothold. “The point of entry of the attack was a hospital server on which the Remote Desktop Protocol (RDP) service was enabled and accessible via the Internet,” Hancock Health Hospital said in a statement. “Forensic analysis determined that an administrative account setup by a vendor of the hospital was compromised and used to gain unauthorized access to a specific system managed by that vendor.” “Given SamSam's victimology, its impacts are not just felt within the business world, they are also impacting people, especially if we consider the Healthcare sector,” Cisco researchers said. “Non-urgent surgeries can always be rescheduled but if we take as an example patients where the medical history and former medical treatment are crucial the impact may be more severe.” Ransomware results in the following negative consequences:
Ransom payment only guarantees that the attackers get their money; it doesn’t guarantee that the encrypted files will be unlocked. File decryption also doesn’t guarantee the removal of malware infection. How to Prevent SamSam Ransomware Attacks1. Backup and Have a Recovery PlanPerform and test regular data backup and employ a recovery plan that expedites the recovery process. 2. Update All SoftwareKeep all software up-to-date with the latest security updates or patches. Attackers are always on the lookout for vulnerable computers, especially those with unpatched software. If your organization is using JBoss enterprise products, check to see if these are running unpatched versions and if so, patch them immediately. 3. Network SegmentationIn the event that security update isn’t possible, network segmentation is a good way to stop cyberattack or limit the possible impact of a successful cyberattack to the rest of the organization's information systems. 3. Restrict Users’ Ability to Install SoftwareLimit the ability of users to install and run unwanted software applications. User’s restriction may prevent malware installation or limit its capability to spread through the network. 
Huawei IoT Exploit Code Meant for DDoS Attack Released to the PublicAnother malware code that’s meant to cause distributed denial-of-service (DDoS) has recently been made public on Pastebin website. The publication of the code of a DDoS threat can’t be taken lightly. Whenever new cyberexploits become publicly available, cybercriminals are quick to add these to their attack arsenal. When the Mirai malware code – another DDoS threat was made public – it unleashed unprecedented DDoS attacks. The newly published malware code is a Mirai variant and particularly targets the vulnerability in Huawei home router model HG532. According to security researchers at NewSky Security, the newly published malware has already been used in cyberattacks, including the Satori DDoS attack. With the release of the full working code of this Mirai variant, security researchers at NewSky Security said that “we expect its usage in more cases by script kiddies and copy-paste botnet masters.” Considering that Huawei retains a significant share of the router market, exploitation of these IoT devices can have a significant effect. According to IDC, Huawei's total router market share increased from 18.9% in the 2nd quarter of 2016 to 25.2% in the 2nd quarter of 2017. What is Satori?Satori is an updated variant of the Mirai malware. It particularly exploits the vulnerability in Huawei home router model HG532. The vulnerability allows remote code execution, enabling attackers to access and make changes to Huawei home routers found in different parts of the world. Unlike the Mirai malware which relies on default usernames and passwords to infect IoT devices, Satori doesn’t need usernames and passwords. Security researchers at Qihoo 360 Netlab said, “The bot [Satori] itself now does NOT rely on loader/scanner mechanism to perform remote planting, instead, bot itself performs the scan activity. This worm like behavior is quite significant.” According to the security researchers at Qihoo 360 Netlab, in December 2017, the Satori malware was able to infect over 280,000 Huawei routers in just 12 hours. In November 2017, security researchers at Check Point reported that hundreds of thousands of Satori exploits have already been found in the wild. Check Point discreetly informed Huawei about the security vulnerability and soon thereafter the company issued a security update. “An authenticated attacker could send malicious packets to port 37215 to launch attacks,” Huawei said in acknowledging the Satori exploit. “Successful exploit could lead to the remote execution of arbitrary code.” What is Mirai?Satori’s code is based on Mirai malware code. In late September 2016, the hacker simply known as “Anna-senpai” made public the Mirai code. What the original Mirai does was used the internet to search for IoT devices (including wireless cameras and routers) with weak security – particularly those with default usernames and passwords, control these devices and use them to attack targets such as other computers and websites. According to Anna-senpai, 380,000 IoT devices were infected with the Mirai malware to stage a DDoS attack against the Krebs on Security website. Barely a month after the Mirai was published online, the DDoS attacks against Dyn happened. Dyn is a domain name service (DNS) provider which many websites rely upon. The DDoS attacks against Dyn resulted in temporarily shutting down popular websites like Amazon, Twitter and Netflix. “We are able to confirm that a significant volume of attack traffic originated from Mirai-based botnets,” Dyn said in a statement. According to the company, 100,000 IoT devices were infected with the Mirai malware to attack its infrastructure. In early December last year, three men, Paras Jha, Josiah White and Dalton Norman, pleaded guilty in creating and operating the Mirai malware in violation of the US Computer Fraud and Abuse Act. “In the summer and fall of 2016, White, Jha, and Norman created a powerful botnet – a collection of computers infected with malicious software and controlled as a group without the knowledge or permission of the computers’ owners,” the US Department of Justice said in a statement. The US Department of Justice added, “The defendants used the botnet to conduct a number of powerful distributed denial-of-service, or ‘DDOS’ attacks, which occur when multiple computers, acting in unison, flood the Internet connection of a targeted computer or computers.” Jha, in particular, pleaded guilty in conducting a series of DDoS attacks against networks of Rutgers University from November 2014 to September 2016. The DDoS attack on Rutgers University, according to the Department of Defense, temporarily shut down the university’s central authentication server, which maintained the gateway portal through which students, faculty and staff deliver assignments and assessments. According to the US Department of Justice, White, Jha and Norman’s involvement with the original Mirai ended in the fall of 2016, when Jha publicly released the source code of Mirai. The Justice Department said, “Since then, other criminal actors have used Mirai variants in a variety of other attacks.” US Acting Assistant Attorney General Cronan said that the Mirai is a powerful reminder that “as we continue on a path of a more interconnected world, we must guard against the threats posed by cybercriminals that can quickly weaponize technological developments to cause vast and varied types of harm.” Since the release of the Mirai code, there has also been a noticeable increase in DDoS-for-hire – a group of cybercriminals that provides paying customers with distributed denial of service (DDoS) attack service to anonymously attack any internet-connected target. Imperva Incapsula reported that in the third quarter of 2017, majority or 90.2% of DDoS attacks were under 10 Mpps and were predominantly the result of DDoS-for-hire activity. DDoS attacks are costly. They can make your organization’s website slow or inaccessible. They can disrupt business activities, prevent customers from accessing online accounts and bring about significant costs in remedying the DDoS effects. PreventionHuawei recommends the following measures to circumvent or prevent your Huawei routers from being infected by Satori malware:
Contact us at The Driz Group if you want more information on how to protect your business from DDoS attacks in under an hour, with no hardware to buy, and no resources or ongoing maintenance. |
AuthorSteve E. Driz, I.S.P., ITCP 
Archives
March 2025
Categories
All
|
RSS Feed
1/26/2018
0 Comments