Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

8/21/2019
01:00 PM
100%
0%

State-Sponsored Cyberattacks Target Medical Research

Cancer research is a particular target among Chinese espionage groups, says security firm FireEye.

Online attackers from Russia, Vietnam, and especially China are targeting healthcare data and stealing intellectual property from hospitals, pharmaceutical companies, and research universities, according to a new report published today by security firm FireEye. 

While cybercriminals continue to be the most prolific attackers, many of the most significant attacks appear to be intelligence operations aimed at stealing research or gathering information on specific individuals, states the "Beyond Compliance: Cyber Threats and Healthcare" report. In particular, Chinese espionage groups appear to be focused on procuring cancer-related research, which the company argues is driven by increasing cancer mortality in China and the associated costs.

"There is not just one group focused on this, but multiple Chinese groups conducting these operations," says Luke McNamara, principal intelligence analyst at FireEye. "Cancer is one of the leading causes of death in China, and there is a big focus on improving cancer treatments on the part of their pharmaceutical industry."

The report collects both FireEye's internal research and open source intelligence on threats. The company found the most frequent threat is that of opportunistic cybercriminals compromising systems and and destructive attacks, such as ransomware.

In the last quarter of 2018 and the first quarter of 2019, the company found multiple databases from healthcare organizations on sale on online black market forums. For example, a 4.31-gigabyte file of healthcare records from a US organizations, including patient data, driver's licenses, and insurance information, was being sold for $2,000. Personally identifiable information (PII) and protected health information (PHI) are often used to conduct fraud or to craft more focused attacks.

"Actors buying and selling PII and PHI from healthcare institutions and providers in underground marketplaces is very common, and will almost certainly remain so due to this data's utility in a wide variety of malicious activity ranging from identity theft and financial fraud to crafting of bespoke phishing lures," the report states.

The healthcare industry is a popular target for online criminals and nation-state operators. In June, a number of medical-testing service providers, such as LabCorp and Quest Diagnostics, announced a breach of their collections-service partner, American Medical Collection Agency, resulted in almost 20 million patient records being stolen.

Yet attackers are also focusing heavily on research data, including information on research participants and pharmaceutical and biomedical intellectual property, FireEye's McNamara says. The purpose of the attacks likely falls into "two buckets," he says. 

"Some are focused on entities that have access to large data sets — those attacks are about getting large-scale data collection in furtherance of intelligence operations and finding specific people," McNamara says. "Then there is the targeting of medical researchers by Chinese espionage groups. You see it going across multiple APT groups going back many years."

The second category of cyber operations is particularly focused on cancer research, according to FireEye's report. In April, a China-linked espionage group attacked a US-based health center focused on cancer research, attempting to lure researchers into clicking on a document that referenced a research conference. 

Such attacks are not uncommon. One Chinese espionage group, APT22, targeted the same institution for many years. An advanced persistent threat (APT) group is the industry term for sophisticated attackers that specifically target certain companies, organizations, or agencies. 

Another Chineses group, APT41, targeted biotech companies and the medical subsidiary of a large corporation, FireEye stated. 

China is not the only actor targeting biomedical research. At least two Russian APT groups and a Vietnam-based group have conducted operations that have either targeted healthcare organizations or had a focus on the biological sciences. For example, one group — APT 28, sometimes called "Fancy Bear" — attacked the World Anti-Doping Association (WADA), which tests Olympic athletes for use of banned drugs and supplements.

The report also underscores the threat posed by attacks that aim to have a cyber-physical impact, such as ransomware that attempts to halt operations or the targeting of medical devices to harm patients.

"Looking forward, the increasing number of biomedical devices used for critical functions within hospitals and healthcare providers presents a growing security challenge," the report concluded. "Furthermore — given their importance and value — a growing willingness by cyber crime, or, in a period of heightened geopolitical tensions, nation state actors — to deploy disruptive and destructive tools may significantly increase the impact from these threats we have observed to date."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

 

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18387
PUBLISHED: 2019-10-23
Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
CVE-2019-18212
PUBLISHED: 2019-10-23
XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal.
CVE-2019-18213
PUBLISHED: 2019-10-23
XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF (as well as SMB connection initiation that can lead to NetNTLM challenge/response cap...
CVE-2019-18384
PUBLISHED: 2019-10-23
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=*public*%25252Fadmin_OnlyRead.txt substring.
CVE-2019-18385
PUBLISHED: 2019-10-23
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring.