New and more virulent strains of ransomware have targeted U.S. healthcare facilities and other victims in the last few weeks, prompting the FBI to investigate and issue a call for help to security experts.
One of the ransomware strains, called PowerWare, is especially worrisome because it targets entire networks using the Windows PowerShell administration software. PowerWare infects PCs by inserting malicious code into Word documents and using a PowerShell script and Office macros to encrypt folders once a user opens the rigged documents.
Filling seemingly benign Microsoft Office documents with malicious code is not a new attack method, but coupled with PowerWare’s novel approach to encrypting files, it’s a powerful and dangerous combination, security experts said.
“Ransomware authors are always trying to evolve to avoid detection, and using built-in Windows capabilities makes the malicious activity less noticeable,” Tim Erlin, director of IT security and risk strategy for Tripwire, said in a statement to PCMag. “[PowerWare] may change its encryption technique, but it still requires an entry point onto the system. Malicious Word files sent through emails and the use of Microsoft Office macros is a very old vector for this new malware.”
It’s likely that PowerWare or similar ransomware strains were responsible foryesterday’s attack on MedStar Health and two other recent high-profile attacks on medical centers in California and Kentucky. The FBI, which is investigating all three attacks, asked security researchers for immediate assistance last week.
Reuters said it obtained a confidential FBI advisory dated March 25 and sent to IT security firms that said, “We need your help!” That advisory was focused on a strain of ransomware similar to PowerWare that encrypts entire networks at once, rather than one PC at a time.
Ransomware attackers focus on the healthcare industry because they have sensitive data and have shown a willingness to pay the ransoms rather than spend extended amounts of time trying to unlock the data themselves.
“Such targets are particularly vulnerable because they cannot afford to be paralyzed for a long time (either because their data has been encrypted or because they shut down the system to avoid spreading the infection) and prefer to pay the ransom,” David Melamed, a research engineer at CloudLock, said in a statement to PCMag.
Ultimately, there’s little IT administrators can do to recover from or prevent these attacks until the security community learns more about them and their perpetrators are discovered. In the meantime, hospitals and other high-risk targets will have to rely on traditional security measures to prevent and mitigate attacks, said Jack Danahy, a co-founder of the IT security start-up Barkly.
“It will be interesting to see the outcome of law enforcement action in this attack,” he said in a statement emailed to PCMag. “Hospitals who have remained unscathed to this point should be double-checking their protection, their backups, and their logs.”
