McAfee Labs Report ‘Follows The Money’ To Assess Criminal Operations Behind Hospital Ransomware

Investigation Tracks Hospital Ransomware Payments Through Bitcoin Accounts; Ransomware, Mobile, and Macro Malware Threats Surge in Q2 2016

 NEWS HIGHLIGHTS

• Intel Security tracks $100,000 in targeted hospital ransomware payments through suspect Bitcoin accounts; investigates operations of $121 million ransomware network
• Intel Security survey shows healthcare and manufacturing sectors are among the least prepared to prevent data loss
• More than 25% of companies surveyed do not monitor sharing of or access to employee or customer data
• Only 37% of organisations surveyed use endpoint monitoring of user activity and physical media activity
• 90% of respondents have cloud protection strategies, but only 12% have visibility into data activity in the cloud
• New mobile malware reaches highest level recorded in Q2 2016; total mobile malware grows 151% year over year
• Total ransomware grows 128% year over year; macro malware grows 106%

LONDON, UK.  Intel Security today released its McAfee Labs Threats Report: September 2016, which assesses the growing ransomware threat to the healthcare industry, surveys the “who and how” of data loss, explains the practical application of machine learning in cybersecurity, and details the growth of ransomware, mobile malware, macro malware, and other threats in Q2 2016.

Following a rash of targeted ransomware attacks upon hospitals in early 2016, Intel Security investigated the attacks, the ransomware networks behind them, and the payment structures enabling cybercriminals to monetise their malicious activity. The researchers identified nearly $100,000 in payments from hospital ransomware victims to specific bitcoin accounts. While healthcare is still clearly a small proportion of the overall ransomware ‘business,’ McAfee Labs expects a growing number of new industry sectors to be targeted by the extensive networks launching such attacks.

In the first half of 2016, our researchers identified a ransomware author and distributor who appeared to receive $121 million (BTC 189,813) in payments from ransomware operations targeting a variety of sectors.  Dark net discussion board communications suggest that this particular cybercrime actor had accumulated profits of $94 million during the first six months of this year.

The scale of the operation is in line with research McAfee Labs conducted with its Cyber Threat Alliance partners in late October 2015, when the group uncovered a ransomware operation using the CryptoWall ransomware strain to extort nearly $325 million over the course of two months.

The research team attributes the increased focus on hospitals to such organisations’ reliance on legacy IT systems, medical devices with weak or no security, third-party services that may be common across multiple organisations, and hospitals’ need for immediate access to information to deliver the best possible patient care.

Raj Samani, CTO EMEA at Intel Security: 

“With cyber security threats including ransomware rising at such a rapid rate, organisations are having to come to terms with the fact that it’s fast becoming a question of ‘when’, not ‘if’, they suffer a breach.

“As such, to stay ahead of cyber criminals, companies must think beyond simply implementing protection strategies, to putting systems in place to rapidly detect threats and correct their systems in the event of an attack. Industries such as financial services and retail have been aware of this threat for some time and have largely taken measures to implement such strategies. It’s crucial that the likes of healthcare and manufacturing pick up the pace with cyber security. Vulnerabilities in these sectors provide hackers with access to extremely personal, valuable and often irreplaceable data and IP.”

Intel Security 2016 Data Loss Prevention Study

 The Q2 report also features the results of a primary research study assessing data loss incidents, including the types of data leaking out, the ways data exits organisations, and the steps organisations must take to take to improve the capabilities of data loss prevention.

The survey found that retail and financial services organisations have deployed the most extensive protections against data loss, a finding McAfee Labs attributes to organisational responses to the frequency of cyber-attacks and the value of the data held by companies in these two sectors. Having sustained fewer cyber-attacks historically, healthcare and manufacturing enterprises have made fewer IT security investments and, accordingly, possess the least comprehensive data protection capabilities.

McAfee Labs researchers find the weaker defences in these two sectors particularly disturbing given that cybercriminals continue to shift their focus from easily replaceable payment card numbers to less perishable data such as personally identifiable information, personal health records, intellectual property, and business confidential information.

The research revealed that more than 25% of respondents do not monitor the sharing of or access to sensitive employee or customer information, and only 37% monitor the usage of both, although this figure rises to almost 50% for the largest organisations.

The survey results also show that nearly 40% of data losses involve some kind of physical media, such as thumb drives, but only 37% of organisations use endpoint monitoring of user activity and physical media connections that could counter such incidents. While 90% of respondents claim to have implemented cloud protection strategies, only 12% are confident in their visibility into the activity of their data in the cloud.

Vincent Weafer, Vice President at Intel Security’s McAfee Labs:

“We will always face challenges as we work to prevent the exfiltration of data, wherever it is stored and however it is handled. But organisations can learn a great deal from this study’s consistent theme of the value of greater visibility into events and incidents across the enterprise, and the longer-term value of the data drawn from this monitoring to construct stronger security postures.”

Q2 2016 Threat Activity

In the second quarter of 2016, McAfee Labs’ global threat intelligence network detected 316 new threats every minute, or more than 5 every second, and registered notable surges in ransomware, mobile malware, and macro malware growth:

• Ransomware.The 1.3 million new ransomware samples in Q2 2016 was the highest ever recorded since McAfee Labs began tracking this type of threat. Total ransomware has increased 128% in the past year.
• Mobile malware.The nearly 2 million new mobile malware samples was the highest ever recorded by McAfee Labs. Total mobile malware has grown 151% in the past year.
• Macro malware. New downloader Trojans such as Necurs and Dridex delivering Locky ransomware drove a more than 200% increase in new macro malware in Q2.
• Mac OS malware.The diminished activity from the OSX.Trojan.Gen adware family dropped new Mac OS malware detections by 70% in the second quarter.
• Botnet activity. Wapomi, which delivers worms and downloaders, increased by 8% in Q2. Last quarter’s number two, Muieblackcat, which opens the door to exploits, fell by 11%.
• Network Attacks.Assessing the volume of network attacks in Q2, denial-of-service attacks gained 11% in the quarter to move into first place. Browser attacks dropped by 8% from Q1. These most prominent attack types were followed by brute force, SSL, DNS, Scan, backdoor, and others.

For more information on the financial impact of ransomware attacks on hospitals, please see our blog entitled “Healthcare Organisations Must Consider the Financial Impact of Ransomware Attacks.”

For more information on these focus topics, or more threat landscape statistics for Q2 2016, visit www.mcafee.com for the full report.

For guidance on how organisations can better protect their enterprises from the threats detailed in this quarter’s report, visit Enterprise Blog.

For online safety tips on how consumers can protect themselves from the threats mentioned in this report, visit Consumer Safety Tips Blog.

[su_box title=”About McAfee Labs” style=”noise” box_color=”#336588″][short_info id=’60470′ desc=”true” all=”false”][/su_box]