1.888.900.DRIZ (3749)
The Driz Group
  • Managed Services
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog
  • Managed Services
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog

Cybersecurity Blog

Thought leadership. Threat analysis. Cybersecurity news and alerts.

1/26/2018

0 Comments

New Variant of SamSam Ransomware Targets Health Sector

 
SamSam ransomware

New Variant of SamSam Ransomware Targets Health Sector

​Since the beginning of 2018, several organizations in the health sector have publicly acknowledged that they’ve been hit by the new variant of the ransomware called “SamSam”.
 
Cloud-based electronic health records (EHR) provider Allscripts, Hancock Health Hospital in Greenfield, Indiana; and Adams Memorial Hospital in Decatur, Indiana acknowledged that they’ve been a target by the new variant of SamSam ransomware.
 
Only Hancock Health Hospital admitted that it paid ransom money to the SamSam attackers. The hospital paid the attackers 4 Bitcoins (approximately $55,000 at the time).
 
“The hospital’s leadership, upon consideration of many factors, made the determination to pay the ransom of four bitcoin demanded by the attackers, in order to retrieve the private encryption keys,” Hancock Health CEO Steve Long said in a statement. “We were in a very precarious situation at the time of the attack. With the ice and snow storm at hand, coupled with the one of the worst flu seasons in memory, we wanted to recover our systems in the quickest way possible and avoid extending the burden toward other hospitals of diverting patients. Restoring from backup was considered, though we made the deliberate decision to pay the ransom to expedite our return to full operations.”

​What is SamSam Ransomware?

​SamSam, also known as Samas or Samsa, is a malicious software (malware) that’s categorized as a ransomware. Like other ransomware it encrypts files, locks out users from using their computers and from accessing files, and demands ransom payment in the form of Bitcoin to unlock the encrypted files.
 
Below is a sample of the ransom note of the new SamSam variant prominently displayed on the infected computer.
SamSam ransomware screen
Image by Cisco
​The original version of SamSam ransomware uses JexBoss, a tool that scours the internet for unpatched servers running Red Hat’s JBoss enterprise products. Once attackers gain entry via an unpatched server, they then use other open-sourced tools to collect information on networked computers. This open-sourced tools include the use of widely-used, weak and reuse passwords.
 
Once a computer is infected with SamSam ransomware, this malware proceeds to encrypt files and then demand a ransom. Once the server is infected by SamSam, all the other computers connected to the server are infected as well by the ransomware.
 
The first SamSam ransomware attack was first observed on March 2, 2016. On March 31, 2016, the United States Department of Homeland Security (DHS), in collaboration with Canadian Cyber Incident Response Centre (CCIRC) issued a joint security alert warning about the dangers of ransomware, including SamSam or Samas.
 
"In early 2016, destructive ransomware variants such as … Samas were observed infecting computers belonging to individuals and businesses, which included healthcare facilities and hospitals worldwide,” said DHS and CCIRC.
 
According to Symantec, what sets the original SamSam ransomware from other ransomware is the way this malware reaches its intended targets via unpatched server-side software.
 
“The big takeaway here is the growing trend that criminals are directly targeting organizations in ransomware attacks,” Symantec said. “The success of these recent attacks signals a shift for cybercriminals as they seek to maximize profits by setting their sights on vulnerable businesses.”
 
Attackers using the older version of Samsam ransomware initially asked a payment option of 1 Bitcoin for each PC that has been infected. The ransom payment demand later went up to 1.5 Bitcoin and 1.7 Bitcoin. According to security researchers at Cisco, as of March 23, 2016, SamSam victims paid nearly 275 Bitcoins (approximately $115,000 as one Bitcoin at the time costs $418).
 
Cisco researchers said that one Bitcoin wallet used by attackers to receive ransom payment for the new SamSam ransomware variant started receiving payments since December 25, 2018 and received 26 Bitcoins, valued nearly $300,000 as of January 19, 2018.
 
According to Cisco, there’s a possibility that compromised Remote Desktop Protocol (RDP) servers have played a role in allowing the attackers of the new SamSam variant to obtain an initial foothold.
 
“The point of entry of the attack was a hospital server on which the Remote Desktop Protocol (RDP) service was enabled and accessible via the Internet,” Hancock Health Hospital said in a statement. “Forensic analysis determined that an administrative account setup by a vendor of the hospital was compromised and used to gain unauthorized access to a specific system managed by that vendor.”
 
“Given SamSam's victimology, its impacts are not just felt within the business world, they are also impacting people, especially if we consider the Healthcare sector,” Cisco researchers said. “Non-urgent surgeries can always be rescheduled but if we take as an example patients where the medical history and former medical treatment are crucial the impact may be more severe.”
 
Ransomware results in the following negative consequences:
  • Permanent or temporary loss of critical data
  • Disruption of regular business operations
  • Financial losses as a result of restoring systems and files
  • Potential damage to the organization’s reputation
 
Ransom payment only guarantees that the attackers get their money; it doesn’t guarantee that the encrypted files will be unlocked. File decryption also doesn’t guarantee the removal of malware infection.

How to Prevent SamSam Ransomware Attacks

1. Backup and Have a Recovery Plan

Perform and test regular data backup and employ a recovery plan that expedites the recovery process.

2. Update All Software

Keep all software up-to-date with the latest security updates or patches. Attackers are always on the lookout for vulnerable computers, especially those with unpatched software. If your organization is using JBoss enterprise products, check to see if these are running unpatched versions and if so, patch them immediately.

3. Network Segmentation

In the event that security update isn’t possible, network segmentation is a good way to stop cyberattack or limit the possible impact of a successful cyberattack to the rest of the organization's information systems.

3. Restrict Users’ Ability to Install Software

Limit the ability of users to install and run unwanted software applications. User’s restriction may prevent malware installation or limit its capability to spread through the network.

0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    Author

    Steve E. Driz, I.S.P., ITCP

    Picture
    View my profile on LinkedIn

    Archives

    March 2023
    February 2023
    January 2023
    December 2022
    June 2022
    May 2022
    February 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    December 2018
    November 2018
    October 2018
    September 2018
    August 2018
    July 2018
    June 2018
    May 2018
    April 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    October 2017
    September 2017
    August 2017
    July 2017
    June 2017
    May 2017
    April 2017
    March 2017
    February 2017
    January 2017
    December 2016
    October 2016
    August 2016
    May 2016
    March 2016
    January 2016
    November 2015
    October 2015
    August 2015
    June 2015

    Categories

    All
    0-Day
    2FA
    Access Control
    Advanced Persistent Threat
    AI
    Artificial Intelligence
    ATP
    Awareness Training
    Botnet
    Bots
    Brute Force Attack
    CASL
    Cloud Security
    Compliance
    COVID 19
    COVID-19
    Cryptocurrency
    Cyber Attack
    Cyberattack Surface
    Cyber Awareness
    Cyber Espionage
    Cybersecurity
    Cyber Security
    Cyber Security Consulting
    Cyber Security Insurance
    Cyber Security Risk
    Cyber Security Threats
    Cybersecurity Tips
    Data Breach
    Data Governance
    Data Leak
    Data Leak Prevention
    DDoS
    Email Security
    Fraud
    GDPR
    Hacking
    Impersonation Scams
    IoT
    Malware
    MFA
    Microsoft Office
    Mobile Security
    Network Security Threats
    Phishing Attack
    Privacy
    Ransomware
    Remote Access
    SaaS Security
    Social Engineering
    Supply Chain Attack
    Supply-Chain Attack
    Third-Party Risk
    Virtual CISO
    Vulnerability
    Vulnerability Assessment
    Web Applcation Security
    Web-applcation-security
    Web Application Firewall
    Web Application Protection
    Web Application Security
    Web Protection
    Windows Security
    Zero Trust

    RSS Feed

Picture

1.888.900.DRIZ (3749)

Managed Services

Picture
Web Application Security
​Virtual CISO
Compliance
​Vulnerability Assessment
Free Vulnerability Assessment
Privacy Policy | CASL

About us

Picture
Testimonials
​Meet the Team
​Subsidiaries
​Contact us
​Blog
​
Jobs

Resources & Tools

Picture
​Incident Management Playbook
Sophos authorized partner logo
Picture
© 2023 Driz Group Inc. All rights reserved.
Photo used under Creative Commons from GotCredit