Rhysida Ransomware Trains Its Sights on Healthcare Operations
The new group has already made an impact in multiple countries and industries, including a multistate hospital chain in the US.
![a healthcare professional holding a tablet with a concept image hovering over it. a healthcare professional holding a tablet with a concept image hovering over it.](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt20d9b7a2dcd7daa3/64f14ef596efc9742d2f8e3f/digitalhealthcare_metamorworks-AdobeStock.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Government agencies and cybersecurity firms are on being more vigilant after the US Department of Health and Human Services (HHS) detailed an alert with an overview of Rhysida ransomware.
Rhysida is a ransomware-as-a-service (RaaS) group that is still in its early stages of development, first emerging in May. According to the alert, the group drops the ransomware through "phishing attacks and Cobalt Strike to breach targets' networks and deploy their payloads." It then exploits its victims by calling for a ransom, threatening to publicly distribute the stolen data if the group is not paid. PDF notes are left on the folders that have been affected in the network, with instructions on how to contact the group and make Bitcoin payment.
The victims of the group span various countries in Western Europe, both North and South America, and Australia. Rhysida targets education, government, manufacturing, and technology and managed service sectors, and it has expanded into the healthcare sector in its most recent expansion.
The group was responsible for a recent cyberattack against Prospect Medical Holdings, leading to a system-wide outage that affected 16 hospitals in California, Connecticut, Pennsylvania, and Rhode Island, as well as over 160 clinics in the US. In addition to this, a healthcare operation in Australia was listed on Rhysida's Dark Web site, given a week to pay the ransom before its stolen data was leaked to the public.
"It's not surprising that Rhysida is targeting the healthcare sector, which holds valuable patient data and faces pressure to pay and restore lifesaving services quickly," wrote Jess Parnell, VP of security operations at Centripetal, in an emailed statement. "In order to protect against ransomware attacks, healthcare operators should implement the basics of good cyber defense — adopt least-privileged access to sensitive information, train employees to identify phishing and other social engineering attacks, and keep all software patches up to date."
HHS recommends that healthcare organizations recognize the threat of these cybergroups, educate and train their staff, assess enterprise risk against potential vulnerabilities, and develop a cybersecurity roadmap.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024