1.888.900.DRIZ (3749)
The Driz Group
  • Managed Services
    • SME CyberShield
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog
  • Managed Services
    • SME CyberShield
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog

Cybersecurity Blog

Thought leadership. Threat analysis. Cybersecurity news and alerts.

11/15/2020

0 Comments

Increased Cybercrime Threat to Canadian Healthcare Organizations

 
Cybercrime Threat to Canadian Healthcare Organizations

Increased Cybercrime Threat to Canadian Healthcare Organizations

In recent months, threat actors have launched cyberattacks against organizations in the healthcare sector, including those based in Canada, according to the latest report released by Microsoft.

In the blog post "Cyberattacks targeting health care must stop," Tom Burt, Corporate Vice President for Customer Security and Trust at Microsoft, said that the targets include organizations in the health sector in Canada, France, India, South Korea and the United States. Burt identified three threat groups and gave these threat groups codename: Strontium, Zinc and Cerium.

According to Burt, Strontium uses password spray and brute force login attempts to steal login credentials. “These are attacks [password spray and brute force login attempts] that aim to break into people’s accounts using thousands or millions of rapid attempts,” Burt said.

Password spray refers to a cyberattack that uses a small number of common passwords to brute force large numbers of accounts. Brute force attack, meanwhile, refers to a cyberattack that uses the trial-and-error method in guessing the correct username and password combination.

According to the Corporate Vice President for Customer Security and Trust at Microsoft, Zinc and Cerium use spear-phishing lures for credential theft. Spear-phishing is a cyberattack in which a threat actor, masquerading as a trusted individual or entity, tricks targeted individuals into clicking a bogus email, text message or instant message.

In the case of the threat actor Zinc, the Corporate Vice President for Customer Security and Trust at Microsoft said the spear-phishing lures for credential theft, sending messages with fabricated job descriptions pretending to be recruiters, while threat actor Cerium engaged in spear-phishing email lures using Covid-19 themes while masquerading as World Health Organization representatives.

Ransomware Attacks in the Healthcare Sector

The Canadian, Australian, the U.S. and UK Governments, meanwhile, issued separate alerts warning about the increased ransomware activity targeting the healthcare sector. Ransomware is a type of cyberattack that uses a malicious software (malware) that encrypts victims’ files, locking out victims of these files.

In traditional ransomware attacks, attackers demand from the victims ransom in exchange for the keys that would unlock the encrypted files. Modern-day ransomware attackers not just demand ransom to unlock the encrypted files, they also demand ransom in exchange for not publishing the stolen files gathered during the ransomware attack.

In September of this year, the University Hospital Düsseldorf in Germany reported a ransomware attack. The attack rendered 30 servers used by the hospital inoperable, forcing the hospital to turn away patients even those with life-threatening conditions.

According to German authorities, a patient with a life-threatening condition was turned away and sent to another hospital some 20 miles away and died as a result of the treatment delay. This is the first reported death as a result of a cyberattack.

Threat Actors Tool Evolution

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS) issued the alert “Ransomware Activity Targeting the Healthcare and Public Health Sector,” warning that threat actors targeting the U.S. healthcare sector use the malware called “BazarLoader,” often leading to ransomware attacks, data theft, and the disruption of healthcare services.

In a recent alert “Renewed Cyber Threats to Canadian Health Organizations,” the Canadian Centre for Cyber Security (Cyber Centre) said threat actors targeting the Canadian healthcare sector have been observed using the BazarLoader malware for initial compromise on victims’ networks for the eventual deployment of the ransomware called “Conti,” believed to be the successor of Ryuk ransomware. The Cyber Centre said that the BazarLoader malware is typically deployed via a phishing email.

Phishing, in general, doesn’t have a particular target as its aim is to victimize whoever takes the bait. Opposite to phishing is spear-phishing which targets certain individuals or organizations.

The BazarLoader malware, the Canadian Centre for Cyber Security said, provides a backdoor through which additional malware is introduced to the victim’s network. Once inside the victim’s network, the Cyber Centre said, the malware called “Anchor” is used to maintain a presence on the network. Anchor is comprised of a framework of tools that allows the covert uploading of malicious tools, and, once done, to remove any evidence of malicious activity.

The Australian Cyber Security Centre, meanwhile, issued its own alert "SDBBot Targeting Health Sector," warning that it has observed increased targeting activity against the Australian health sector by threat actors using the SDBBot Remote Access Tool for the eventual deployment of ransomware called “Clop.”

SDBBot has three components: 1) an installer that allows threat actors to establish persistence on the victim’s network; 2) a loader that downloads additional components; and 3) the remote access tool itself allows threat actors full control of compromised computers, remotely. Once inside the victims’ networks, threat actors also use SDBBot to move within the victims’ networks and steal data.

Cybersecurity Best Practices

Below are some of the cybersecurity best practices to mitigate the risks:

  • Keep all operating systems, software and firmware up to date.
  • Regularly change passwords to network systems and accounts and use multi-factor authentication if possible.
  • Disable remote access/Remote Desktop Protocol (RDP) ports if not needed and monitor remote access/RDP logs when used.
  • Practice network segmentation. Critical data shouldn’t be kept on the same server for mundane day-to-day data.
  • Implement the 3-2-1 rule in backing up critical data. This rule states that three copies of critical data should be kept, with two copies kept in different types of storage media, and one copy should be kept offline.

Is your organization at risk? Let us help you evaluate your controls quickly and efficiently.

Email us today at [email protected] and sleep better at night knowing that your business is well protected against cybercriminals.

0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    Author

    Steve E. Driz, I.S.P., ITCP

    Picture
    View my profile on LinkedIn

    Archives

    March 2025
    February 2025
    January 2025
    November 2024
    October 2024
    September 2024
    July 2024
    June 2024
    April 2024
    March 2024
    February 2024
    January 2024
    December 2023
    November 2023
    October 2023
    September 2023
    August 2023
    July 2023
    June 2023
    May 2023
    April 2023
    March 2023
    February 2023
    January 2023
    December 2022
    June 2022
    February 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    December 2018
    November 2018
    October 2018
    September 2018
    August 2018
    July 2018
    June 2018
    May 2018
    April 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    October 2017
    September 2017
    August 2017
    July 2017
    June 2017
    May 2017
    April 2017
    March 2017
    February 2017
    January 2017
    December 2016
    October 2016
    August 2016
    May 2016
    March 2016
    January 2016
    November 2015
    October 2015
    August 2015
    June 2015

    Categories

    All
    0-Day
    2FA
    Access Control
    Advanced Persistent Threat
    AI
    AI Security
    Artificial Intelligence
    ATP
    Awareness Training
    Blockchain
    Botnet
    Bots
    Brute Force Attack
    CASL
    Cloud Security
    Compliance
    COVID 19
    COVID-19
    Cryptocurrency
    Cyber Attack
    Cyberattack Surface
    Cyber Awareness
    Cybercrime
    Cyber Espionage
    Cyber Insurance
    Cyber Security
    Cybersecurity
    Cybersecurity Audit
    Cyber Security Consulting
    Cyber Security Insurance
    Cyber Security Risk
    Cyber Security Threats
    Cybersecurity Tips
    Data Breach
    Data Governance
    Data Leak
    Data Leak Prevention
    Data Privacy
    DDoS
    Email Security
    Endpoint Protection
    Fraud
    GDPR
    Hacking
    Impersonation Scams
    Incident Management
    Insider Threat
    IoT
    Machine Learning
    Malware
    MFA
    Microsoft Office
    Mobile Security
    Network Security Threats
    Phishing Attack
    Privacy
    Ransomware
    Remote Access
    SaaS Security
    Social Engineering
    Supply Chain Attack
    Supply-Chain Attack
    Third Party Risk
    Third-Party Risk
    VCISO
    Virtual CISO
    Vulnerability
    Vulnerability Assessment
    Web Applcation Security
    Web-applcation-security
    Web Application Firewall
    Web Application Protection
    Web Application Security
    Web Protection
    Windows Security
    Zero Trust

    RSS Feed

Picture

1.888.900.DRIZ (3749)

Managed Services

Picture
SME CyberShield
​Web Application Security
​Virtual CISO
Compliance
​Vulnerability Assessment
Free Vulnerability Assessment
Privacy Policy | CASL

About us

Picture
Testimonials
​Meet the Team
​Subsidiaries
​Contact us
​Blog
​
Jobs

Resources & Tools

Picture
​Incident Management Playbook
Sophos authorized partner logo
Picture
© 2025 Driz Group Inc. All rights reserved.
Photo from GotCredit