Ransomware Attacks vs Hospitals: Hacker Groups Take Different Stances

Hackers armed with Ryuk ransomware refuse to back off attacking hospitals despite a number of other crews pledging to leave alone medical institutions struggling to treat people stricken with the coronavirus.

It’s a reminder for managed security service providers (MSSPs) not to let their guard down and not to count on the cyber decency of threat groups even in these perilous, pandemic times.

Hackers With A Heart?

Still, it’s not all bad. While there are some that see opportunity in the pandemic and aren’t hesitating to hit healthcare organizations at their most vulnerable, a call around by Bleeping Computer to a few crews found some vowing not to target healthcare organizations.

For example, the Ryuk cyber extortionists, which earlier this year disabled three hospitals in Alabama, have targeted at least 10 healthcare organizations in the last month, SentinelOne’s security researcher Vitali Kremez told BleepingComputer. Two of the targets are independent medical facilities while another is the hub of nine U.S. hospitals, Kremez reportedly said. "Not only has their healthcare targeting not stopped but we have also seen a continuous trend of exploiting healthcare organizations in the middle of the global pandemic,” he said. With Covid-19 sweeping the world and overwhelming hospitals a ransomware attack could easily make the difference between life and death.

On the other hand, while not a shining example of cyber civility, operators behind a number of ransomware groups BleepingComputer contacted said they would no longer target hospitals during the pandemic. Among those that BleepingComputer reached out to were CLOP, DoppelPaymer, Maze, Netilimer and Netwalker. Others contacted without a response included Sodinokibi/REvil, PwndLocker, and Ako.

More Hacker Insights

Here’s what a few had to say to BleepingComputer about attacking hospitals:

Clop, DoppelPaymer and Nefilim said they will provide free decryptors if necessary. Security providers Emsisoft and Coveware are offering free of charge ransomware decryption and negotiation services to healthcare providers during the Coronavirus pandemic, the companies recently said. Services include: Technical analysis of the ransomware, development of a decryption tool whenever possible and, if necessary, transaction handling and recovery assistance.