Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

8/21/2019
01:00 PM
100%
0%

State-Sponsored Cyberattacks Target Medical Research

Cancer research is a particular target among Chinese espionage groups, says security firm FireEye.

Online attackers from Russia, Vietnam, and especially China are targeting healthcare data and stealing intellectual property from hospitals, pharmaceutical companies, and research universities, according to a new report published today by security firm FireEye. 

While cybercriminals continue to be the most prolific attackers, many of the most significant attacks appear to be intelligence operations aimed at stealing research or gathering information on specific individuals, states the "Beyond Compliance: Cyber Threats and Healthcare" report. In particular, Chinese espionage groups appear to be focused on procuring cancer-related research, which the company argues is driven by increasing cancer mortality in China and the associated costs.

"There is not just one group focused on this, but multiple Chinese groups conducting these operations," says Luke McNamara, principal intelligence analyst at FireEye. "Cancer is one of the leading causes of death in China, and there is a big focus on improving cancer treatments on the part of their pharmaceutical industry."

The report collects both FireEye's internal research and open source intelligence on threats. The company found the most frequent threat is that of opportunistic cybercriminals compromising systems and and destructive attacks, such as ransomware.

In the last quarter of 2018 and the first quarter of 2019, the company found multiple databases from healthcare organizations on sale on online black market forums. For example, a 4.31-gigabyte file of healthcare records from a US organizations, including patient data, driver's licenses, and insurance information, was being sold for $2,000. Personally identifiable information (PII) and protected health information (PHI) are often used to conduct fraud or to craft more focused attacks.

"Actors buying and selling PII and PHI from healthcare institutions and providers in underground marketplaces is very common, and will almost certainly remain so due to this data's utility in a wide variety of malicious activity ranging from identity theft and financial fraud to crafting of bespoke phishing lures," the report states.

The healthcare industry is a popular target for online criminals and nation-state operators. In June, a number of medical-testing service providers, such as LabCorp and Quest Diagnostics, announced a breach of their collections-service partner, American Medical Collection Agency, resulted in almost 20 million patient records being stolen.

Yet attackers are also focusing heavily on research data, including information on research participants and pharmaceutical and biomedical intellectual property, FireEye's McNamara says. The purpose of the attacks likely falls into "two buckets," he says. 

"Some are focused on entities that have access to large data sets — those attacks are about getting large-scale data collection in furtherance of intelligence operations and finding specific people," McNamara says. "Then there is the targeting of medical researchers by Chinese espionage groups. You see it going across multiple APT groups going back many years."

The second category of cyber operations is particularly focused on cancer research, according to FireEye's report. In April, a China-linked espionage group attacked a US-based health center focused on cancer research, attempting to lure researchers into clicking on a document that referenced a research conference. 

Such attacks are not uncommon. One Chinese espionage group, APT22, targeted the same institution for many years. An advanced persistent threat (APT) group is the industry term for sophisticated attackers that specifically target certain companies, organizations, or agencies. 

Another Chineses group, APT41, targeted biotech companies and the medical subsidiary of a large corporation, FireEye stated. 

China is not the only actor targeting biomedical research. At least two Russian APT groups and a Vietnam-based group have conducted operations that have either targeted healthcare organizations or had a focus on the biological sciences. For example, one group — APT 28, sometimes called "Fancy Bear" — attacked the World Anti-Doping Association (WADA), which tests Olympic athletes for use of banned drugs and supplements.

The report also underscores the threat posed by attacks that aim to have a cyber-physical impact, such as ransomware that attempts to halt operations or the targeting of medical devices to harm patients.

"Looking forward, the increasing number of biomedical devices used for critical functions within hospitals and healthcare providers presents a growing security challenge," the report concluded. "Furthermore — given their importance and value — a growing willingness by cyber crime, or, in a period of heightened geopolitical tensions, nation state actors — to deploy disruptive and destructive tools may significantly increase the impact from these threats we have observed to date."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

 

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19551
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not b...
CVE-2019-19552
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user...
CVE-2019-19620
PUBLISHED: 2019-12-06
In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions from a malicious file.
CVE-2019-19625
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2) leaks node information due to a leaky default configuration as indicated in the policy/defaults/dds/governance.xml document.
CVE-2019-19627
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration. (SROS2 provides the tools to generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2.)