New Variant of SamSam Ransomware Targets Health Sector

New Variant of SamSam Ransomware Targets Health Sector

​Since the beginning of 2018, several organizations in the health sector have publicly acknowledged that they’ve been hit by the new variant of the ransomware called “SamSam”.
 
Cloud-based electronic health records (EHR) provider Allscripts, Hancock Health Hospital in Greenfield, Indiana; and Adams Memorial Hospital in Decatur, Indiana acknowledged that they’ve been a target by the new variant of SamSam ransomware.
 
Only Hancock Health Hospital admitted that it paid ransom money to the SamSam attackers. The hospital paid the attackers 4 Bitcoins (approximately $55,000 at the time).
 
“The hospital’s leadership, upon consideration of many factors, made the determination to pay the ransom of four bitcoin demanded by the attackers, in order to retrieve the private encryption keys,” Hancock Health CEO Steve Long said in a statement. “We were in a very precarious situation at the time of the attack. With the ice and snow storm at hand, coupled with the one of the worst flu seasons in memory, we wanted to recover our systems in the quickest way possible and avoid extending the burden toward other hospitals of diverting patients. Restoring from backup was considered, though we made the deliberate decision to pay the ransom to expedite our return to full operations.”

​What is SamSam Ransomware?

​SamSam, also known as Samas or Samsa, is a malicious software (malware) that’s categorized as a ransomware. Like other ransomware it encrypts files, locks out users from using their computers and from accessing files, and demands ransom payment in the form of Bitcoin to unlock the encrypted files.
 
Below is a sample of the ransom note of the new SamSam variant prominently displayed on the infected computer.

Image by Cisco

​The original version of SamSam ransomware uses JexBoss, a tool that scours the internet for unpatched servers running Red Hat’s JBoss enterprise products. Once attackers gain entry via an unpatched server, they then use other open-sourced tools to collect information on networked computers. This open-sourced tools include the use of widely-used, weak and reuse passwords.
 
Once a computer is infected with SamSam ransomware, this malware proceeds to encrypt files and then demand a ransom. Once the server is infected by SamSam, all the other computers connected to the server are infected as well by the ransomware.
 
The first SamSam ransomware attack was first observed on March 2, 2016. On March 31, 2016, the United States Department of Homeland Security (DHS), in collaboration with Canadian Cyber Incident Response Centre (CCIRC) issued a joint security alert warning about the dangers of ransomware, including SamSam or Samas.
 
"In early 2016, destructive ransomware variants such as … Samas were observed infecting computers belonging to individuals and businesses, which included healthcare facilities and hospitals worldwide,” said DHS and CCIRC.
 
According to Symantec, what sets the original SamSam ransomware from other ransomware is the way this malware reaches its intended targets via unpatched server-side software.
 
“The big takeaway here is the growing trend that criminals are directly targeting organizations in ransomware attacks,” Symantec said. “The success of these recent attacks signals a shift for cybercriminals as they seek to maximize profits by setting their sights on vulnerable businesses.”
 
Attackers using the older version of Samsam ransomware initially asked a payment option of 1 Bitcoin for each PC that has been infected. The ransom payment demand later went up to 1.5 Bitcoin and 1.7 Bitcoin. According to security researchers at Cisco, as of March 23, 2016, SamSam victims paid nearly 275 Bitcoins (approximately $115,000 as one Bitcoin at the time costs $418).
 
Cisco researchers said that one Bitcoin wallet used by attackers to receive ransom payment for the new SamSam ransomware variant started receiving payments since December 25, 2018 and received 26 Bitcoins, valued nearly $300,000 as of January 19, 2018.
 
According to Cisco, there’s a possibility that compromised Remote Desktop Protocol (RDP) servers have played a role in allowing the attackers of the new SamSam variant to obtain an initial foothold.
 
“The point of entry of the attack was a hospital server on which the Remote Desktop Protocol (RDP) service was enabled and accessible via the Internet,” Hancock Health Hospital said in a statement. “Forensic analysis determined that an administrative account setup by a vendor of the hospital was compromised and used to gain unauthorized access to a specific system managed by that vendor.”
 
“Given SamSam's victimology, its impacts are not just felt within the business world, they are also impacting people, especially if we consider the Healthcare sector,” Cisco researchers said. “Non-urgent surgeries can always be rescheduled but if we take as an example patients where the medical history and former medical treatment are crucial the impact may be more severe.”
 
Ransomware results in the following negative consequences:

• Permanent or temporary loss of critical data
• Disruption of regular business operations
• Financial losses as a result of restoring systems and files
• Potential damage to the organization’s reputation

 
Ransom payment only guarantees that the attackers get their money; it doesn’t guarantee that the encrypted files will be unlocked. File decryption also doesn’t guarantee the removal of malware infection.

How to Prevent SamSam Ransomware Attacks

1. Backup and Have a Recovery Plan

Perform and test regular data backup and employ a recovery plan that expedites the recovery process.

2. Update All Software

Keep all software up-to-date with the latest security updates or patches. Attackers are always on the lookout for vulnerable computers, especially those with unpatched software. If your organization is using JBoss enterprise products, check to see if these are running unpatched versions and if so, patch them immediately.

3. Network Segmentation

In the event that security update isn’t possible, network segmentation is a good way to stop cyberattack or limit the possible impact of a successful cyberattack to the rest of the organization's information systems.

3. Restrict Users’ Ability to Install Software

Limit the ability of users to install and run unwanted software applications. User’s restriction may prevent malware installation or limit its capability to spread through the network.