Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

8/21/2019
01:00 PM
100%
0%

State-Sponsored Cyberattacks Target Medical Research

Cancer research is a particular target among Chinese espionage groups, says security firm FireEye.

Online attackers from Russia, Vietnam, and especially China are targeting healthcare data and stealing intellectual property from hospitals, pharmaceutical companies, and research universities, according to a new report published today by security firm FireEye. 

While cybercriminals continue to be the most prolific attackers, many of the most significant attacks appear to be intelligence operations aimed at stealing research or gathering information on specific individuals, states the "Beyond Compliance: Cyber Threats and Healthcare" report. In particular, Chinese espionage groups appear to be focused on procuring cancer-related research, which the company argues is driven by increasing cancer mortality in China and the associated costs.

"There is not just one group focused on this, but multiple Chinese groups conducting these operations," says Luke McNamara, principal intelligence analyst at FireEye. "Cancer is one of the leading causes of death in China, and there is a big focus on improving cancer treatments on the part of their pharmaceutical industry."

The report collects both FireEye's internal research and open source intelligence on threats. The company found the most frequent threat is that of opportunistic cybercriminals compromising systems and and destructive attacks, such as ransomware.

In the last quarter of 2018 and the first quarter of 2019, the company found multiple databases from healthcare organizations on sale on online black market forums. For example, a 4.31-gigabyte file of healthcare records from a US organizations, including patient data, driver's licenses, and insurance information, was being sold for $2,000. Personally identifiable information (PII) and protected health information (PHI) are often used to conduct fraud or to craft more focused attacks.

"Actors buying and selling PII and PHI from healthcare institutions and providers in underground marketplaces is very common, and will almost certainly remain so due to this data's utility in a wide variety of malicious activity ranging from identity theft and financial fraud to crafting of bespoke phishing lures," the report states.

The healthcare industry is a popular target for online criminals and nation-state operators. In June, a number of medical-testing service providers, such as LabCorp and Quest Diagnostics, announced a breach of their collections-service partner, American Medical Collection Agency, resulted in almost 20 million patient records being stolen.

Yet attackers are also focusing heavily on research data, including information on research participants and pharmaceutical and biomedical intellectual property, FireEye's McNamara says. The purpose of the attacks likely falls into "two buckets," he says. 

"Some are focused on entities that have access to large data sets — those attacks are about getting large-scale data collection in furtherance of intelligence operations and finding specific people," McNamara says. "Then there is the targeting of medical researchers by Chinese espionage groups. You see it going across multiple APT groups going back many years."

The second category of cyber operations is particularly focused on cancer research, according to FireEye's report. In April, a China-linked espionage group attacked a US-based health center focused on cancer research, attempting to lure researchers into clicking on a document that referenced a research conference. 

Such attacks are not uncommon. One Chinese espionage group, APT22, targeted the same institution for many years. An advanced persistent threat (APT) group is the industry term for sophisticated attackers that specifically target certain companies, organizations, or agencies. 

Another Chineses group, APT41, targeted biotech companies and the medical subsidiary of a large corporation, FireEye stated. 

China is not the only actor targeting biomedical research. At least two Russian APT groups and a Vietnam-based group have conducted operations that have either targeted healthcare organizations or had a focus on the biological sciences. For example, one group — APT 28, sometimes called "Fancy Bear" — attacked the World Anti-Doping Association (WADA), which tests Olympic athletes for use of banned drugs and supplements.

The report also underscores the threat posed by attacks that aim to have a cyber-physical impact, such as ransomware that attempts to halt operations or the targeting of medical devices to harm patients.

"Looking forward, the increasing number of biomedical devices used for critical functions within hospitals and healthcare providers presents a growing security challenge," the report concluded. "Furthermore — given their importance and value — a growing willingness by cyber crime, or, in a period of heightened geopolitical tensions, nation state actors — to deploy disruptive and destructive tools may significantly increase the impact from these threats we have observed to date."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

 

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19782
PUBLISHED: 2019-12-13
The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server.
CVE-2019-19777
PUBLISHED: 2019-12-13
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.
CVE-2019-19778
PUBLISHED: 2019-12-13
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c.
CVE-2019-16777
PUBLISHED: 2019-12-13
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of pa...
CVE-2019-16775
PUBLISHED: 2019-12-13
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publi...