U.S. Healthcare Sector Warned About Maui Ransomware Attacks by North Korean Hackers

Posted By Richard Anderson on Jul 7, 2022 |

North Korean state-sponsored hackers are targeting organizations in the U.S. healthcare and public health sector (HPH) and are using Maui ransomware for extortion, according to a recent joint cybersecurity advisory from the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Department of the Treasury.

Ransomware attacks on healthcare providers can prevent access to electronic medical records stopping healthcare providers from accessing patient data. The attacks can also disrupt diagnostic and imaging services and disable intranets. Attacks involving Maui ransomware have caused major disruption to victims, with that disruption sometimes continuing for long periods of time.

According to the security advisory, North Korean hackers have been conducting attacks on the HPH sector in the United States since at least May 2021. The vectors used to gain access to the servers of HPH organizations are not known, but a sample of the ransomware has been obtained and analyzed by the FBI. The FBI reports that the ransomware is most likely deployed manually using a command-line interface once initial access to servers has been gained. The ransomware uses a combination of Advanced Encryption Standard (AES), RSA, and XOR encryption to encrypt the targeted files, and after file encryption, a ransom demand is issued.

The FBI, CISA, and the Treasury believe the HPH sector is being targeted because the threat actors assume there is a higher probability of the ransom being paid than organizations in other sectors due to the disruption caused and the patient safety issues attacks create. The Feds believe attacks on the sector are likely to continue.

The FBI said it understands that payment of the ransom may have to be considered to lessen the harm to shareholders, employees, and patients, but payment of the ransom is strongly discouraged. Organizations that have paid ransoms in the past have found that they have still been unable to recover their files. In some cases, after a victim has paid the ransom, a further ransom demand is issued, and paying ransoms only encourages more attacks. The alert also highlights the risk of sanctions by the Treasury’s Office of Foreign Assets Control (OFAC). Financial penalties can be imposed on organizations that violate OFAC sanctions and make payments to malicious cyber actors on its sanctions list, as payment threatens U.S. national security interests. Regardless of whether or not the ransom is paid, victims should still report the incident to their local FBI field office or CISA and should share as much information as possible about the attack.

The advisory details several mitigations that organizations in the HPH sector can implement to prepare for ransomware attacks, reduce the likelihood of an attack succeeding, and limit the harm caused if ransomware is deployed. IoCs have also been shared to help network defenders identify and block attacks in progress, as detailed in the table below