Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

8/21/2019
01:00 PM
100%
0%

State-Sponsored Cyberattacks Target Medical Research

Cancer research is a particular target among Chinese espionage groups, says security firm FireEye.

Online attackers from Russia, Vietnam, and especially China are targeting healthcare data and stealing intellectual property from hospitals, pharmaceutical companies, and research universities, according to a new report published today by security firm FireEye. 

While cybercriminals continue to be the most prolific attackers, many of the most significant attacks appear to be intelligence operations aimed at stealing research or gathering information on specific individuals, states the "Beyond Compliance: Cyber Threats and Healthcare" report. In particular, Chinese espionage groups appear to be focused on procuring cancer-related research, which the company argues is driven by increasing cancer mortality in China and the associated costs.

"There is not just one group focused on this, but multiple Chinese groups conducting these operations," says Luke McNamara, principal intelligence analyst at FireEye. "Cancer is one of the leading causes of death in China, and there is a big focus on improving cancer treatments on the part of their pharmaceutical industry."

The report collects both FireEye's internal research and open source intelligence on threats. The company found the most frequent threat is that of opportunistic cybercriminals compromising systems and and destructive attacks, such as ransomware.

In the last quarter of 2018 and the first quarter of 2019, the company found multiple databases from healthcare organizations on sale on online black market forums. For example, a 4.31-gigabyte file of healthcare records from a US organizations, including patient data, driver's licenses, and insurance information, was being sold for $2,000. Personally identifiable information (PII) and protected health information (PHI) are often used to conduct fraud or to craft more focused attacks.

"Actors buying and selling PII and PHI from healthcare institutions and providers in underground marketplaces is very common, and will almost certainly remain so due to this data's utility in a wide variety of malicious activity ranging from identity theft and financial fraud to crafting of bespoke phishing lures," the report states.

The healthcare industry is a popular target for online criminals and nation-state operators. In June, a number of medical-testing service providers, such as LabCorp and Quest Diagnostics, announced a breach of their collections-service partner, American Medical Collection Agency, resulted in almost 20 million patient records being stolen.

Yet attackers are also focusing heavily on research data, including information on research participants and pharmaceutical and biomedical intellectual property, FireEye's McNamara says. The purpose of the attacks likely falls into "two buckets," he says. 

"Some are focused on entities that have access to large data sets — those attacks are about getting large-scale data collection in furtherance of intelligence operations and finding specific people," McNamara says. "Then there is the targeting of medical researchers by Chinese espionage groups. You see it going across multiple APT groups going back many years."

The second category of cyber operations is particularly focused on cancer research, according to FireEye's report. In April, a China-linked espionage group attacked a US-based health center focused on cancer research, attempting to lure researchers into clicking on a document that referenced a research conference. 

Such attacks are not uncommon. One Chinese espionage group, APT22, targeted the same institution for many years. An advanced persistent threat (APT) group is the industry term for sophisticated attackers that specifically target certain companies, organizations, or agencies. 

Another Chineses group, APT41, targeted biotech companies and the medical subsidiary of a large corporation, FireEye stated. 

China is not the only actor targeting biomedical research. At least two Russian APT groups and a Vietnam-based group have conducted operations that have either targeted healthcare organizations or had a focus on the biological sciences. For example, one group — APT 28, sometimes called "Fancy Bear" — attacked the World Anti-Doping Association (WADA), which tests Olympic athletes for use of banned drugs and supplements.

The report also underscores the threat posed by attacks that aim to have a cyber-physical impact, such as ransomware that attempts to halt operations or the targeting of medical devices to harm patients.

"Looking forward, the increasing number of biomedical devices used for critical functions within hospitals and healthcare providers presents a growing security challenge," the report concluded. "Furthermore — given their importance and value — a growing willingness by cyber crime, or, in a period of heightened geopolitical tensions, nation state actors — to deploy disruptive and destructive tools may significantly increase the impact from these threats we have observed to date."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

 

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
7 Ways VPNs Can Turn from Ally to Threat
Curtis Franklin Jr., Senior Editor at Dark Reading,  9/21/2019
Security Pros Value Disclosure ... Sometimes
Dark Reading Staff 9/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I wish they'd put a sock in it.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16691
PUBLISHED: 2019-09-23
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2019-16707
PUBLISHED: 2019-09-23
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
CVE-2019-16708
PUBLISHED: 2019-09-23
ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.
CVE-2019-16709
PUBLISHED: 2019-09-23
ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.
CVE-2019-16710
PUBLISHED: 2019-09-23
ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.