Microsoft to Hospitals: Update VPN Security on Ransomware Threat

Microsoft has told “several dozen hospitals” to immediately patch weaknesses in their virtual private network (VPN) infrastructure after finding evidence that a ransomware crew was probing for weaknesses to exploit.

The VPN threats targeting hospitals are particularly ominous as the coronavirus (Covid-19) rampages across the globe. While some ransomware groups have pledged not to hit hospitals others armed with Ryuk malware have refused to back off in yet another stark example for managed security service providers (MSSPs) not to let their guard down.

Ransomware attackers have been zeroing in on VPN servers from Citrix, Fortinet, Palo Alto Networks and Pulse Secure used in hospital settings, ZDNet reported. A "targeted notification" of this magnitude is Microsoft's "first-of its kind," the vendor's Threat Protection Intelligence Team wrote in a  new blog post. Hackers have been using the REvil (also known as Sodinokibi) ransomware to “actively exploit gateway and VPN vulnerabilities” in targeted organizations, Microsoft said. "Now more than ever, hospitals need protecting from attacks that can prevent access to critical systems, cause downtime, or steal sensitive information," the post cautioned.

Microsoft Statement on VPN Security

Healthcare organizations straining under the Covid-19 load that haven’t had the time or resources to install security patches, update firewalls, and check the health and privilege levels of users and endpoints are more likely to meet ransom demands, the hackers figure. “Our intel on ransomware campaigns shows an overlap between the malware infrastructure that REvil was observed using last year and the infrastructure used on more recent VPN attacks," Microsoft said.

Bad actors are repurposing old tactics, techniques and procedures (TTP) and social engineering rather than deploying technical innovations in new attacks to capitalize on the Covid-19 crisis, using “human-operated attack methods to target organizations that are most vulnerable to disruption,” Microsoft said. Cyber crews behind this type of attacks are not your garden variety data kidnappers. They typically command extensive knowledge of systems administration and common network security misconfigurations.

Ransomware hackers have identified healthcare organizations as “big game” targets to hijack critical business systems to extort millions, previous reports said. Earlier this year, cybercriminals used REvil to target unpatched Pulse Secure VPN servers to disable antivirus software. The ransomware has previously been used to attack managed service providers (MSPs), Texas local governments and encrypt data of hundreds of dentist offices.

Two weeks ago, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) warned all organizations to patch VPN services.

Microsoft VPN Security Guidance

To reduce the risk from threats that exploit gateways and VPN vulnerabilities, Microsoft “strongly recommends” that hospitals and other organizations immediately take these four measures:

Early last month, Microsoft published a report and provided mitigation steps for making networks resistant against threats and cyberattacks in general.