Category: Cybersecurity News

A New Mexico federal judge has approved Rehoboth McKinley Christian Health Care Services’ proposed settlement to take care of claims associated with a February 2021 cyberattack. The settlement will pay affected individuals up to a maximum of $4,000 per person for out-of-pocket expenses sustained and lost time in response to the data breach.

Rehoboth McKinley Christian Health Care Services manages a 60-bed acute care hospital and outpatient clinics and offers home health care services in Arizona and New Mexico. The provider detected a security breach in February 2021. The investigation confirmed that unauthorized persons got access to its system from January 21 to February 5, 2021. The attackers accessed the protected health information (PHI) of around 191,000 patients, which include names, contact details, Social Security numbers, health data, and medical insurance data. Patients received notification concerning the data breach last May 2021.

The Charlie et al. versus Rehoboth McKinley Christian Health Care Services lawsuit was submitted on behalf of Leona Garcia Lacey, Alicia Charlie, Darrell Tsosie, and a small child, which has a representing guardian Gary Hicks. Allegedly, Rehoboth McKinley Christian Health Care Services was unable to apply proper safety measures to avert unauthorized access to their PHI and furthermore unnecessarily delayed sending notifications to impacted patients.

The lawsuit claimed Rehoboth McKinley Christian Health Care Services did not follow the New Mexico and Arizona consumer protection laws, and had claims of negligence, breach of implied contract, breach of fiduciary duty, and intrusion upon seclusion. However, the judge rejected the claims for breach of implied contract, intrusion upon seclusion, and the violation of the Arizona Consumer Fraud Act. Rehoboth McKinley Christian Health Care Services had contended that there was no actionable obligation to safeguard the plaintiffs’ information, however, U.S. District Court Judge Steven C. Yarbrough decided that Rehoboth McKinley Christian Health Care Services had a duty of ordinary care to the plaintiffs with regards to the retention of their private data and didn’t show that lost time recovery in relation to the breach wasn’t allowed under state legislation.

As per the conditions of the settlement, the 191,009 people in the class may file claims for as much as $500 to compensate for standard out-of-pocket expenditures, which may include around 4 hours of lost time valued at $15 hourly. Standard expenditures include bank charges, long-distance telephone charges, cell phone and data costs, postage, fuel for local travel, credit report charges, and credit monitoring and identity theft insurance services. Claims could likewise be filed for documented outstanding out-of-pocket expenditures as much as $3,500. Unlike a lot of settlements which are compensated pro rata according to the number of claims, this arrangement will pay the entire $4,000 for all class members. Class members will likewise be given 2 years of free credit monitoring services. Rehoboth McKinley Christian Health Care Services has additionally consented to improve data protection. A final fairness hearing will be on May 24, 2022.

The Office of Inspector General of the U.S. Department of the Interior (DOI OIG) has observed poor password management and enforcement procedures at the Department of the Interior resulting in heightened risk for its critical IT systems. These fundamental password blunders are very typical in the healthcare sector and make it overly easy for threat actors to acquire initial access to systems to launch ransomware attacks as well as other nefarious functions.

A check up was performed on the password difficulty required by the department to know whether its password management and enforcement procedures were useful and could possibly stop malicious actors from employing brute force tactics to acquire unauthorized account access. The DOI OIG discovered a number of password management weak spots and a lot of weak passwords. 4.75% of accounts were protected utilizing variations of ‘password’, which can be cracked immediately by a threat actor. Password-1234 was employed to secure 478 different, unrelated accounts. Five of the 10 most reused passwords have the term password and the number string 1234.

Although the DOI had followed minimum requirements for password difficulty, these guidelines were outdated and not fit anymore for its purpose. There were additionally numerous cases of users using passwords that satisfied those requirements yet were nevertheless quite weak, for example, Changeme$12345 and P@s$w0rd. Without time limits set on passwords, even somewhat complex passwords are weak to brute force attacks. Moreover, with unused accounts that were not deactivated promptly, 6,000 accounts were put at risk.

DOI OIG conducted tests to crack passwords and was able to do so within 90 minutes. DOI rightly guessed about 16% of the passwords. Overall, the test were conducted on 85,944 department passwords. 18,174 passwords or 21% were guessed correctly, which include 288 passwords for accounts with elevated privileges and 362 accounts owned by senior government staff. Besides these password management problems, the DOI did not regularly use multi-factor authentication. The DOI OIG inspection showed 89% of high-value assets didn’t use multi-factor authentication even though it is required for 15 years now. Additionally, when told to show records of which accounts had implemented multi-factor authentication, there was no list presented.

The DOI OIG stated that the ransomware attack on Colonial Pipeline in 2021, which led to the shutdown of the gas pipeline to the Eastern Seaboard of the U.S. creating substantial disruption to nearly half of the country’s fuel source, happened because of the compromise of one password. The password management errors discovered by DOI OIG are very prevalent throughout federal, state, and local governments as well as public and private companies.

The DOI OIG made a number of suggestions for enhancing password management and enforcement, such as

• monitoring MFA
• making sure it is used for all accounts
• establishing new minimum prerequisites for password difficulty consistent with the most recent password suggestions of the National Institute of Standards and Technology (NIST SP 800-63)
• applying controls to track, limit, and avoid setting often used, expected, or exposed passphrases and passwords
• making sure to disable inactive accounts promptly

Vulnerabilities were found in Citrix solutions, Zoho ManageEngine products, and Netgear routers that need quick patching. An APT actor is actively exploiting one Citrix vulnerability, and it is probable that there will be attempts to take advantage of the Netgear and Zoho vulnerabilities on devices without patching.

Active Exploitation of Citrix ADC and Citrix Gateway Vulnerabilities

In the middle of December, companies that utilize the Citrix ADC load balancing and/or Citrix Gateway remote access solutions were encouraged to quickly upgrade to the most recent software versions to repair two critical vulnerabilities, CVE-2022-27518 and CVE-2022-27510. The National Security Agency (NSA) and the Health Sector Cybersecurity Coordination Center (HC3) gave security warnings concerning the vulnerabilities. A Chinese APT actor is known to exploit one vulnerability to execute remote code on vulnerable servers.

According to a new scan by Fox-IT, in spite of active exploitation, a number of servers are still vulnerable. The majority of those servers are found in the U.S. For several weeks now, one vulnerability is being actively targeted. Therefore, all companies that have not applied the most recent version yet must do so right away and likewise check for probable exposure. These are the security advisories from the NSA and HC3

Immediate Patching Required for Critical Zoho ManageEngine Vulnerability

Zoho is informing all customers of its ManageEngine Password Manager Pro, PAM360, along with Access Manager Plus solutions to use the latest version of the software immediately to correct a critical SQL injection vulnerability. CVE-2022-47523 can be taken advantage of by an enemy to acquire unauthenticated access to the after-sales database and accomplish customized questions.

The patches, introduced at the end of December, put appropriate validation and escape of special characters to stop vulnerability exploitation. Users ought to update to Access Manager Plus v4309 and Password Manager Pro v12210, PAM360 v 5801.

Nation-state threat actors have previously exploited ManageEngine vulnerabilities. A Chinese APT actor is believed to have influenced the 2021 vulnerability on Internet-facing servers, as pointed out in a security alert from CISA and the FBI, therefore taking advantage of the recently disclosed vulnerability may be expected. Approximately 11,000 servers control the impacted tools and will be vulnerable when not upgraded to the newest versions.

High-Severity Vulnerability Discovered in Netgear Routers

Netgear has given a security advisory concerning a high-severity pre-authentication buffer overflow a weakness impacting a lot of versions of its routers, which can be taken advantage of by an enemy to bring about a denial-of-service condition. The vulnerability is monitored as PSV-2019-0104 with a CVSS v3 severity score of 7.4.

The vulnerability impacts the RAX35, RAX40, R6400v2, R6400v3, R6900P, R7000, R7000P, R7960P, and R8000P routers. End users ought to upgrade the software program immediately to avoid taking advantage of the vulnerability. The chosen firmware versions are the following:

• R6400v2 + R6700v3 – Version 1.0.4.122
• RAX40 + RAX35 – Version 1.0.2.60
• R6900P + R7000P – Version 1.3.3.152
• R7000 – Version 1.0.11.136
• R7960P + R8000P – Version 1.4.4.94

 

Southwest Louisiana Health Care System, Inc. recently announced the compromise of the protected health information (PHI) of approximately 269,752 Lake Charles Memorial Health System patients. The Louisiana healthcare system’s security team detected suspicious activity on October 21, 2022 and took steps to deal with the occurrence and look into the potential breach. It was confirmed on October 25 that an unauthorized entity got access to the system. The forensic investigators stated that the attack began on October 20 to October 21, 2022 and the attackers stole patient records from the system.

The analysis of the extracted files confirmed they included data such as names, addresses, birth dates, patient ID numbers, medical record numbers, medical insurance data, payment details, and limited clinical data. A number of Social Security numbers were likewise breached. The health system sent breach notification letters to impacted persons on December 23, 2022, and offered free credit monitoring and identity theft protection services to those who had their Social Security numbers exposed.

Southwest Louisiana Health Care System didn’t reveal the precise method of the cyberattack, however, the Hive ransomware group professed to be behind the attack. Although Hive is well-known for employing ransomware for file encryption, the group claims to have only extracted patient records. It did not encrypt the files and issued a ransom demand asking for payment to make sure to delete the stolen information. Payment doesn’t seem to have been given because the Hive group began leaking the stolen information last month.

FoundCare Email Account Breach Affects 14,000 Patients

The federally qualified health center known as FoundCare Inc. based in Palm Springs, FL has reported that unauthorized persons have acquired access to its email account and possibly viewed or acquired email messages and files containing the PHI of 14,194 patients.

The health center detected suspicious activity in its email account on September 2, 2022, and engaged a third-party digital forensics agency to investigate. FoundCare stated it confirmed on October 18, 2022, that the breached files contained patient information. The analysis of those records and checking of patient contact details were done. Currently, FoundCare is sending notification letters to the impacted persons. Information compromised during the cyberattack included the following: names, dates of birth, email addresses, addresses, Social Security numbers, credit card numbers, passport numbers, other government ID numbers, medical insurance details, health conditions, internal patient identifiers, diagnoses, and treatment data. FoundCare mentioned that most of the affected persons only had minimal medical data compromised.

FoundCare has applied the following extra security procedures because of the breach:

• using multifactor authentication for all end users
• stopping basic authentication steps
• including an alert to all emails coming from new email addresses
• giving employees regular phishing awareness training

 

NYC Health + Hospitals Warns Patients Concerning Loss of Device With PHI

NYC Health + Hospitals reports a faulty hard drive that stored the protected health information (PHI) of 2,174 patients was found to be gone from a visual field testing device situated at its NYC Health + Hospitals/Woodhull facility in Brooklyn, NY. Since the drive can’t be located it was not possible to confirm if the records on the device could be accessed, nevertheless, it was stated that the device comprised patients’ names, birth dates, visual field test data, and medical record numbers.

As a result of the breach, NYC Health + Hospitals has re-trained employees on its policy for the right chain of custody for devices comprising PHI when those units are taken out of service. Moreover, a new policy was applied that calls for PHI to be taken from visual testing devices consistently. The training was additionally enhanced to ensure all employees are aware of the need to promptly notify officials about potential breaches of PHI.

Unauthorized System Access Discovered by Missouri Law Firm

Law company Polsinelli PC based in Kansas City, MO, which offers hospitals corporate legal services, states that unauthorized individuals viewed files that had patient records on September 9, 2022, from two locations. A third-party cybersecurity firm investigated the breach and confirmed that the breach did not affect its network and main document repository; nonetheless, the files that were accessed included some patient data, such as names, addresses, birth dates, health insurance details, patient account numbers, medical record numbers, very limited clinical data, and Social Security numbers. St. Luke’s Health Brazosport patients are found to have been affected.

Individuals whose Social Security numbers were impacted got offers of credit monitoring and identity theft protection services. Nevertheless, the law agency believes that no compromised information will be utilized for identity theft or fraud. The HHS Office for Civil Rights already received the breach report, which indicated that 1,220 persons were affected.

Patient Information Exposed Due to Hawaiian Eye Center Cyberattack

Hawaiian Eye Center located in Wahiawa, HI recently began informing a number of patients that unauthorized individuals accessed some of their PHI that was saved on a server. It was discovered on November 2, 2022 that the server was unresponsive. Upon investigation, it was confirmed that an unauthorized individual accessed the server and the network. The attackers also exfiltrated files from the system that contain patient data.

Those files included names, birth dates, addresses, email addresses, driver’s license numbers, Social Security numbers, medical record numbers, and medical insurance data. The eye center informed the impacted persons and offered them single-bureau credit monitoring services. It also engaged third-party cybersecurity professionals to perform an evaluation of its security procedures and systems and implemented appropriate upgrades to avoid more breaches later on.

It is presently uncertain how many persons were impacted.

Insider Data Breach at The Elizabeth Hospice

nonprofit hospice, The Elizabeth Hospice, manages facilities in Carlsbad, Escondido, Temecula, and San Diego, CA. It found out that an ex-employee was sending email messages from her email account at work to a private account when she was working at the hospice. An analysis of the email messages was finished on November 14, 2022. It confirmed that they included first and last names, admission and discharge dates, basic health data, and patient account numbers. The Elizabeth Hospice stated it did not know of any actual or attempted patient data misuse. Still, affected individuals were instructed to be wary and monitor unauthorized activity in their accounts and statements.

It is presently unknown how many people were impacted.

CommonSpirit Health has reported the exposure and potential theft of the protected health information (PHI) of about 623,774 patients because of a
ransomware attack in October 2022. CommonSpirit Health initially announced that it encountered a cyberattack last October 4, 2022, and is posting frequent updates on its site as soon as addtional information regarding the attack is available. The provider discovered the attack on October 2, 2022 and the investigation confirmed that the attackers got access to areas of its system from September 16 to October 3.

The most recent update, released on December 1, 2022, stated that the persons responsible for the attack viewed the information of patients who got healthcare services previously, or affiliates of those persons, from Franciscan Medical Group and/or Franciscan Health (known today as Virginia Mason Franciscan Health) located in Washington state, which includes patients of St. Anne Hospital (previously Highline Hospital), St. Joseph Hospital, St. Michael Medical Center (previously Harrison Hospital), St. Anthony Hospital, St. Elizabeth Hospital, St. Clare Hospital, and St. Francis Hospital.

The breached information consists of names, internal patient IDs, addresses, telephone numbers, and birth dates. CommonSpirit Health mentioned that the breach had no impact on Dignity Health, TriHealth, Centura Health, or Virginia Mason Medical Center facilities.

75,992-Record Data Breach Reported by Suncoast Skin Solutions

Suncoast Skin Solutions based in a Lutz, FL is a medical and cosmetic dermatology practice network. It just began informing its patients about a cyberattack that it discovered on or about July 14, 2021. The network took prompt action to control the attack. Third-party forensics specialists investigated the incident and confirmed the nature and extent of the data breach.

The investigation was completed on October 21, 2022. It was confirmed that the files on the system included patient information accessed during the attack. Nevertheless, the attack did not affect its electronic medical record system. Initial analysis identified the types of data impacted, which was finished on November 8, 2021. That analysis showed that only old patient information was affected.

Suncoast began issuing notification letters to impacted persons on November 28, 2022. Based on the breach notification letter submitted to the Maine Attorney General by Suncoast, the long delay in sending notification letters was because of the nature and volume of the impacted information. The data mining procedure began in December 2021, and it was completed in October 2022. Suncoast stated that in the beginning, so as to follow the HIPAA Breach Notification Rule, it issued a media notice about the data breach on January 7, 2022 and posted it on its website.

The potentially compromised information included names, birth dates, clinical data, doctor’s records, and some treatment data. Credit monitoring services were provided to impacted persons. Suncoast sent the breach report to the HHS’ Office for Civil Rights in July indicating that 57,730 persons were impacted. The new notification sent to the Maine Attorney General shows that 75,992 persons were impacted.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have recently given guidance for federal and private organizations on the reduction and mitigation of distributed Denial of Service (DDoS) attacks.

These attacks are carried out to overload apps and websites with traffic, therefore rendering them inaccessible and stopping legitimate users from getting access to that service. A Denial of Service (DoS) attack leads to a network resource overload that affects all bandwidth, hardware, and software, protocol resource overloads affect the available session or connection sources, and application resource overloads utilize all compute or storage assets.

With DDoS attacks, the traffic originates from several devices that are acting together. They may entail big amounts of traffic and have the probability to trigger hardware troubles. Botnets or slave armies of malware-attacked devices are frequently utilized to execute DDoS attacks at scale, and they are much more prevalent because of the big increase in IoT devices. The botnets are frequently rented out to threat actors, therefore, enabling unskilled individuals to carry out DDoS attacks.

These attacks may be temporary; however, continuous attacks can considerably interrupt critical services, leading to substantial remediation expenses and significant reputational harm. These attacks are just concerned with creating disruption and do not involve getting access to systems or data theft; nevertheless, cybercriminal groups are known to carry out DDoS attacks to distract IT teams at the same time an attack is carried out on another portion of the network. With the focus of security groups focused elsewhere, there is less chance that data exfiltration, malware download, or ransomware deployment will be noticed. It is consequently essential that any response to a DDoS attack does not lead to the neglect of other security monitoring.

Stopping and Minimizing the Effect of DDoS Attacks

What is important to protecting against DDoS attacks and minimizing their severity is preparation. All vital assets and services that are accessible to the public Internet should be identified, with those applications and services prioritized. It is important to implement web application firewalls to secure the most critical assets. Cybersecurity protocols must be implemented, including hardening servers and patching immediately. Understanding how users connect to the services and knowing any chokepoints can make it less difficult to carry out mitigations to stop interruption to key stuff.

Think about enlisting in a DDoS protection service, ideally, a dedicated DDoS protection service, because those offered by ISPs are not as strong and may not safeguard against bigger attacks. These services enable the identification of the source of the attack and will reroute traffic somewhere else. Managed Service Providers can probably assist and provide DDoS protection, which includes giving custom network edge defense services.

Do something to avoid single points of failure, for example, having a high-value asset hosted on a single node. Load balancing throughout multiple loads is recommended. It is additionally important to create an incident response plan, particularly for DDoS attacks. All stakeholders ought to keep in mind their duties through all phases of an attack to make sure a quick and efficient response is possible. You should likewise develop a business continuity plan to make certain that business operations can carry on in the event of an attack, and tabletop exercises must be done to check those plans.

Steps to Take During an Attack

In the event of an alleged attack, like when there is network latency, slow application performance, abnormally high traffic, or the unavailability of websites, technical experts ought to be contacted for support. Check with your ISP to find out if they have an outage, and understand the nature of the attack, like where the traffic is originating from and which apps are being targeted. This will let you to employ targeted mitigations and work with service providers to block the attack immediately.

Although an attack may target a particular application, keep track of other network assets, as they may be concurrently attacked. Specific mitigations for dealing with DDoS attacks are mentioned in the MS-ISAC Guide to DDoS Attacks.

Recovering from a DDoS Attack

Following an attack, continue monitoring all network resources, learn from the response, and revise your incident response plan appropriately to correct any facet of the response plan that didn’t run efficiently. You must furthermore make sure you proactively keep an eye on your network and create a baseline of normal activity since this will enable you to quickly identify ongoing attacks in the future.

The 2022 Mid-Year Report of Check Point has shown that the healthcare sector got the highest percentage increase in cyberattacks among all industries. Cyberattacks in the first half of 2022 are higher by 69% than in 2021. Healthcare currently holds the fifth-highest record in the number of attacks per week, next to the sectors of education, military/government, ISP/MSP, and communications.

According to Check Point’s report, cyberattacks in 2022 have become completely established as a state-level weapon, having seen an unprecedented increase in state-sponsored attacks during the first half of 2022 because of the continuous war in Ukraine. In addition, there’s a significant rise in hacktivism or the employment of private individuals for an ‘IT Army’ for executing attacks. Check Point states the after-effects of this are expected to be experienced by governments and businesses around the world.

The power of cyberattacks to impact day-to-day lives is very clear. In 2022, attacks on TV stations stopped broadcasting, and attacks on critical infrastructure and government units disrupted important services. A lot of these attacks were done in Ukraine, however, this is a global problem. The attack on Costa Rica upset services throughout the country, which include healthcare, and it wasn’t a singled-out incident, with the same attack impacting Peru soon after. Cyberattacks with a nationwide effect could become more prevalent. In education, the ransomware attack on Lincoln College compelled it to shut down after 157 years, and many ransomware attacks on healthcare companies have resulted in serious interruptions to medical services.

There are more cybercriminal groups undertaking attacks for monetary gain on specific companies as nation-state-level attackers. The Conti ransomware operation, because of Costa Rica’s decision not to give ransom payment, wanted to depose the government by inciting a revolution. A number of cybercriminal organizations now have hundreds of people and have incomes of millions to billions of dollars. In a number of instances, these organizations operate like real companies, with a few even getting physical property, and running at that level becomes hard without some support from the governments of the nations where they are located. There has additionally been a pattern that cyber criminals don’t use ransomware entirely, and rather, choose to do plain extortion or data theft and demand a ransom payment. This is what the Lapsus$, Karakurt, and RansomHouse threat groups are doing.

Check Point’s information reveals a 42% increase in cyberattacks around the world from January to June of 2022. The following lists the gathered statistics:

• 23% of business networks experienced attacks with multipurpose malware
• 15% were attacked with crypto miners
• 13% experienced infostealer infections
• 12% experienced mobile attacks
• 8% experienced ransomware attacks

Attacks on the healthcare sector increased by 69% with 1,387 attacks on companies per week on average.

In the Americas, Emotet has become the most frequent malware threat after law enforcement took it down in January 2021 which halted the attacks. Emotet is being employed in 8.6% of malware attacks in the first half of 2022, with an extensive selection of malware variants now being employed, such as XMRig (1.9%), Remcos (2.3%), and Formbook (4.2%).

High-profile vulnerabilities are still being exploited to acquire access to business networks, such as the Apache Log4j RCE vulnerability (CVE-2021-44228), the F5 BIG IP RCE vulnerability (CVE-2022-1388), and the Atlassian Confluence RCE vulnerability (CVE-2022-26134).

Check Point has predicted the attack trends for the rest of the year according to recognized trends in the first half of 2022. Ransomware is likely to be a more fragmented ecosystem, the deactivation of macros will see more varied email infection chains used, hacktivism is predicted to change, and attacks on the crypto and blockchain platforms are anticipated to go up.

Check Point recommends the following cybersecurity improvements:

• installing updates and patches on a regular basis
• installing anti-ransomware solutions
• implementing a prevention-first strategy and approach
• collaborating with the police and national cyber authorities
• improving education regarding cyber threats
• preparing by employing and testing incident response programs that can be
• instantly followed in case of a successful attack

Businesses are seeing the value of cybersecurity and the need to spend more on cybersecurity because threats are changing at a fast rate. The challenge for companies is making sure that their defenses enable them to block the actions of cybercriminals, however, the rate at which data breaches are reported indicates a lot of companies are having difficulties keeping up.

To know how to secure their companies, IT leaders must understand how cybercriminals are breaking defenses. Then, they can decide about the security options they need to spend on that will give good ROI with regards to security.

Keeper Security lately performed a survey on 516 IT decision-makers in the United States to learn how cybersecurity is changing and where companies are purchasing cybersecurity resources. Keeper released the survey results in its U.S. Cybersecurity Census Report for 2022. The report talks about the risks that companies face and the tactics they may follow to better handle cyber threats and to stay ahead of the cyber criminals that are attacking their networks.

Businesses Making Cybersecurity a Key Priority

According to the survey, 71% of companies had new hires in cybersecurity over the last 12 months. But despite more skilled employees, businesses worry that they can’t keep pace with the quick-changing cyber threat landscape.

U.S. company experiences about 42 cyberattacks per year and IT leaders forecast that attacks will grow in the following 12 months. Most of the respondents stated they believe in their capability to protect against cyber threats and that they have the needed cybersecurity tools to guard against attacks, although a majority of surveyed companies encountered a successful cyberattack last year. IT chiefs additionally state that identifying and responding to cyberattacks now takes longer.

The Effect of Cyberattacks on Businesses

31% of companies stated they had suffered a successful cyberattack causing interrupted partner/customer operations. The same number said that attacks brought about stolen financial data. 28% mentioned that the attacks resulted in reputational damage, and the same number also mentioned stolen corporate data. About 25 % said the attacks disrupted the supply chain as well as the trading/business operations. There is a significant financial effect on businesses because of the attacks. The average cost of successful attacks to businesses is $75,000 per case. More or less 4 in 10 companies said that the cost to resolve attacks is over $100,000.

Lacking Technology to Fight Cyberattacks

Although the confidence in cybersecurity defenses was high, the survey showed the technology being employed to protect against attacks was lacking the necessary tools. About 33% of companies have no management system for IT secrets, for example, database passwords, privileged credentials, and API keys. 84% of survey respondents were worried regarding hard-coded credentials in source code, nevertheless, 25% of companies didn’t have any software program to remove them.

58% of Americans today work remotely, yet over 25% of businesses mentioned they have no remote connection management system set up allowing their remote workers to access their IT infrastructure securely.

The survey also discovered identity and access management vulnerabilities. Merely 44% of businesses stated they have employees guidelines on regulating passwords and access management. Three out of 10 companies allow their workers to set and handle their own passwords and confessed that employees often share their passwords. Just 26% of companies said they own a highly advanced framework for visibility and controling identity security.

The laissez-faire method of access management show that there’s more to do to protect businesses and their workers. The following lists the major areas of security that companies plan to spend on in the following 12 months:

• security awareness training (54%)
• developing a culture of compliance (50%)
• password management (48%)
• enhancing visibility to identify network threats (44%)
• infrastructure secrets management (42%)
• passwordless authentication (42%)
• use a zero-trust and zero-knowledge strategy to security (32%)

Although it is good to see numerous companies making cybersecurity the main priority, the survey showed too little transparency regarding cyberattacks at lots of businesses. 48% of IT leaders admitted that they knew about a cyberattack but didn’t report it to the appropriate authority. This shows a need to develop a culture of trust, responsibility, and responsiveness to stop cyber criminals from thriving.

Ransomware attacks still trouble the healthcare sector. The attacks interrupt services because vital IT systems are being shut down. Having no access to electronic health records (EHR) may result in patient safety problems, and it is typical to redirect emergency patients to other hospitals right away after attacks and to postpone appointments.

Lately, cybersecurity company Trend Micro performed a study to look at the effect ransomware attacks have on healthcare companies. The study was participated by 145 companies and IT decision-makers within the industry. Sapio Research did a more substantial worldwide study on the ransomware threat participated by 2,958 IT security decision-makers in 26 nations.

Trend Micro’s study shows that 25% of all data breaches today are due to ransomware. From 2017 to 2021, ransomware attacks went up by 109%, and there’s a 13% year-over-year increase in attacks in 2022. These attacks are causing a serious effect on healthcare companies, which are actively attacked by a number of ransomware groups.

57% of healthcare companies stated they had encountered a ransomware attack in the last 3 years. 86% of healthcare companies that experienced a ransomware attack had operational shutdowns because of the attack. 25% of companies that encountered an attack were compelled to totally stop operations. 60% mentioned that certain business functions were interrupted as a result of an attack.

The time to recover from these attacks may be substantial, with healthcare companies facing interruption to their services for prolonged time periods. 56% of companies that participated in the survey stated it took a few days to recoup from the ransomware attack, with 24% indicating it took a few weeks to completely bring back operations following an attack.

Stealing data is now prevalent in ransomware attacks with attackers issuing threats to post or sell the stolen information in case the ransom is not paid. This strategy has become so profitable that a number of cybercriminal groups have left ransomware completely and only steal data and issue threats to publish when payment is not given. 60% of surveyed companies stated sensitive information was stolen and exposed by the threat actors, with the information theft and leakage resulting in reputational ruin, compliance problems, and increasing costs of the investigation, remediation, and clean-up.

The research signifies healthcare companies are proactively countering the threat and improving their security. 95% of surveyed companies mentioned they are patching immediately to handle software vulnerabilities, 91% have put in place extra controls to stop malicious email attachments from landing in inboxes, and adopted enhanced detectors and response solutions for their network (NDR) and endpoints (EDR) is increasing, just like the usage of extended detection and response (XDR) tools.

There is additionally great concern regarding supply chains. 43% of survey respondents stated their partners turned them into more appealing targets for attacks, 43% stated they lack awareness throughout the ransomware attack chain making them more susceptible to attacks. 36% stated the insufficiency of visibility throughout attack surfaces made them a much bigger target.

Nevertheless, the survey showed a number of security gaps. For example, 17% of survey respondents didn’t have any remote desktop controls ready, in spite of RDP vulnerabilities frequently being taken advantage of to obtain initial access to healthcare systems. There is substantial room for development regarding threat intelligence sharing, as 30% confessed to not discussing threat information with partners, 46% never give threat intelligence to suppliers or the broader ecosystem, and one-third (33%) mentioned they never share any data with the authorities.

Merely 51% of companies utilize NDR, 50% employ EDR, and 43% utilize XDR, with just 46% of companies tracking living-of-the-land strategies like the malicious usage of tools including PsExec and MimiKatz. Just 42% claim they could identify initial access and only 32% could identify lateral movement.

In the healthcare industry, ransomware could have a possibly very real and very harmful physical effect. Operational outages endanger patient lives. So healthcare companies must get better at recognition and response and share with their partners the relevant intelligence to protect their supply chains.

Cybersecurity Awareness Month is being celebrated this October. For 19 years, the government and industry have collaborated to increase awareness of cybersecurity in America. This effort is headed by the National Cybersecurity Alliance (NCA) and the Cybersecurity and Infrastructure Security Agency (CISA).

This year’s Cybersecurity Awareness Month theme is “See Yourself in Cyber.” The emphasis is on the steps that all people must take to enhance cybersecurity. In the past years, the four weeks in October have different themes. This 2022, instead of having a different theme every week, the emphasis for each week is going to be one of the four key behaviors that should be adopted by everyone. Just practicing the four fundamentals of cybersecurity will significantly enhance a person’s and a company’s security posture.

• Implementing multifactor authentication – Enhance access controls by putting additional authentication criteria besides a password. MFA could prevent granting access to accounts utilizing stolen credentials.
• Employing a password manager and requiring strong passwords – All accounts must have strong, unique passwords to be tough against brute force attacks. Use a password manager to generate passwords and keep them safely in an encrypted password vault.
• Keeping software up to date – Make certain software is updated and implement patches immediately to fix known vulnerabilities.
• Identifying and reporting phishing attacks- Understand the indicators of phishing, the warning indicators in email messages, SMS messages, social media content, and phone calls that could suggest a phishing attempt, and report phishing attempts.

Enhancing Cybersecurity Awareness in the Healthcare Industry

Lots of cyberattacks succeed because of errors by staff members and not knowing the fundamental facets of cybersecurity. Based on the 2022 Verizon Data Breach Investigations Report, 82% of 2021’s data breaches were prompted by humans. Enhancing employees’ security awareness by centering on the above-mentioned behaviors will help improve security and stop data breaches.

Training in security awareness is a necessity for HIPAA Security Rule compliance. The administrative safety measures of the HIPAA Security Rule (45 CFR § 164.308 (a)(5)(i)) demand that all HIPAA-covered entities train their employees about internal security guidelines and procedures.

HIPAA-covered entities must follow a risk-based strategy when creating training courses and must teach cybersecurity fundamentals and consider the most essential behaviors that could minimize risk. The HHS’ Office for Civil Rights has given guidance https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html on the included aspects of cybersecurity in its cybersecurity newsletters every quarter.

The Security Rule calls for covered entities to carry out a security awareness and training program for all employees. A covered entity’s training program must be continuous, changing, and flexible to teach employees how to address new cybersecurity threats. OCR additionally emphasized the necessity of training employees, including management staff and senior officers.

Cybersecurity Awareness Month is the perfect time to emphasize security reminders and create a program for sending these reminders on a regular basis. OCR recommends including security reminders in its cybersecurity newsletters, and doing phishing simulations for employees. HIPAA-covered entities must consider employing a mechanism that enables employees to quickly report attempts at phishing and suspicious emails to their security teams.

Multifactor authentication is a powerful extra protection for enhancing access controls to prevent using stolen credentials to access accounts. This Cybersecurity Awareness month is the perfect time to speed up plans to execute multifactor authentication to all accounts in case it is not yet implemented by MFA. Phishing campaigns are being done that permit some types of multifactor authentication to be circumvented. To safeguard against the attacks to bypass MFA, MFA implementation must use an option that facilitates Fast ID (FIDO) v2.0 and certificate-dependent authentication.

Brute force attacks usually become successful because of employees using weak passwords or using passwords on several accounts. HIPAA-covered entities must implement their password guidelines, and make compliance with those guidelines less difficult for workers by providing a business password manager. Password managers may propose really random, complicated passwords, and significantly boost password security and management.

It is quick to concentrate on technical defenses for securing ePHI and stopping unauthorized access, however, the significance of training can’t be over-emphasized. Making sure all workers know about the previously mentioned key behaviors and are doing good cyber hygiene will truly improve the cybersecurity defenses of the whole company.

The House of Representatives approved the U.S Food and Drug Administration (FDA) user fee reauthorization bill in June along with the new provisions necessitating medical device producers to keep track of and deal with postmarket cybersecurity vulnerabilities found in their units, to make sure that medical devices have labels of a software bill of materials and can get patches to provide cybersecurity for the complete lifecycle of the units. The bill was approved with a 392-28 vote; nonetheless, those cybersecurity demands have been removed.

The FDA’s authorization to receive fees from the healthcare industry to perform third-party reviews of drugs and medical devices will end on September 30, and as time runs out, the FDA gave in to the demand of Senate republicans and removed the new cybersecurity prerequisites for medical device companies. If the FDA’s 5-year authorization will not be renewed, the FDA estimated that it can only proceed with its review activities for about 5 weeks prior to its funds being depleted. The FDA reauthorization was part of a non-permanent spending bill that is already approved and will allow the FDA and the Federal government to get funding until December 16, 2022.

Energy and Commerce Committee Chairman Frank Pallone, Jr. (D-NJ) stated that the House approved a user fee reauthorization package on time with astounding bipartisan support. Following the House approval of its user fee package, the leaders of bipartisan Energy and Commerce and HELP wanted to include a lot of essential policy sections including the Continuing Resolution. Sadly, Senate Republican leadership did not approve these policy agreements.

U.S. Senators Richard Burr (R-NC) and Patty Murray (D-WA), and Chair and Ranking Member of the Senate Committee on Health, Education, Labor, and Pensions (HELP), made a statement regarding the reauthorization of the FDA user fee programs to make sure that FDA could carry on its crucial work and will not have to distribute pink slips. Nevertheless, there is extra work for this Congress to provide the types of reforms families must see from FDA, from the industry, and from the mental health and pandemic readiness work. The senators affirmed their commitment to moving forward with that work and the inclusion of strong, bipartisan laws in a strong year-end package.

The taking away of the cybersecurity prerequisites is a disappointment however not shocking. Healthcare companies must not wait for
changes and must make sure that they proactively determine and deal with vulnerabilities present in medical devices to protect the security of their systems, confidentiality of information, and patient security.

The Michigan law firm, Warner Norcross and Judd LLP, has distributed breach notification letters to 255,160 people telling them about a security breach in October 2021 resulting in the potential access and exfiltration of files containing their personal data and protected health information (PHI). The breach was discovered on October 22, 2021. In the substitute breach notification, there was no mention of when, and for how long, unauthorized persons got access to its systems.

A digital forensics company helped to investigate the nature and magnitude of the data breach and conducted a programmatic and manual evaluation of the files on the affected areas of its network. The assessment showed that the files held information like names, dates of birth, government-issued IDs, driver’s license numbers, Social Security numbers, annual compensation amounts, benefit contribution details, credit or debit card numbers, debit card or credit card PINs, financial account or routing numbers, patient account numbers, passport numbers, health data, and life insurance policy data.

The Michigan Law company sent notification letters to impacted people in August and provided details on tips that persons can do to decrease the risk of identity theft and fraud, however it would seem that credit monitoring and identity theft protection services are not available. The law company stated it is going to take steps to enhance security to stop other security breaches.

Medical Imaging Firms Announces PHI Breach

Gateway Diagnostic Imaging, a company operating 12 medical imaging centers in North Texas, and Radiology Ltd, a medical imaging organization based in Tucson, AZ, have recently began alerting a number of patients regarding a breach of systems that held patient records. The data breach was noticed on December 24, 2021, and the following forensic investigation confirmed that unauthorized people acquired access to its systems between December 17 and December 24, 2021.

The data on the compromised systems comprised data like names, Social Security numbers, birth dates, addresses, medical insurance details, patient account numbers, medical record numbers, physician names, dates of service, and details associated with the radiology services received.

As a safety measure against identity theft and fraud, the firm offered to the affected persons a complimentary 12-month membership to the credit monitoring and identity theft protection service of Equifax Credit Watch Gold. Additional safeguards are also being enforced to avoid more security breaches, and improvements were made to its monitoring features.

The breach is not posted yet on the HHS’ Office for Civil Rights Breach portal so it is currently not clear how many people were impacted.

LastPass, the provider of the most popular password management solution in the world, announced a cyberattack and information breach. As reported by LastPass, there are about 30 million users of its password manager tool around the world, including 85,000 business customers. Notifications were sent to clients to notify them regarding the cyberattack and offer reassurances that although a number of company data were stolen because of the attack, users’ password vaults were not affected and the cyberattack did not result in any problems to its products or services.

Based on the notice released two weeks ago, LastPass found out that an unauthorized individual had acquired access to one programmer’s account, which allowed the attacker access to the LastPass creator’s environment. LastPass stated steps were quickly taken to control the attack and stop continuing unauthorized access, with the forensic investigation verifying the attackers stole sections of its source code and some exclusive LastPass technical data.

Just like the case with a lot of other password management tools, LastPass operates under the zero-knowledge model, meaning it got no access to its end users’ encrypted password vaults. Only individual end users could access their password vaults using the master password and doing multi-factor authentication validations (if MFA is enabled). Karim Toubba, LastPass CEO, mentioned that there’s no evidence that the incident permitted any access to end user information or encrypted password vaults, thus, users don’t have to alter their master passwords.

LastPass stated it is presently analyzing further mitigation methods and will be taking steps to reinforce the protection of its environment. This is not LastPass’ first experience of a cyberattack. In 2015, the company encountered an attack in which hackers had obtained the usernames of selected customers, along with their hashed master passwords. LastPass enforced a password reset as a preventative measure. Since only hashed passwords were stolen, just the end users who had set weak master passwords were at risk.

LastPass users were also targeted in a credential stuffing campaign. LastPass cautioned its users in late 2021 that it had discovered strange, attempted login activity and had seen a slight increase in security notifications associated with user accounts. The investigation affirmed this was because of credential stuffing attacks, where threat actors utilize usernames and passwords compromised in third-party data breaches to try to get access to accounts on other systems. These attacks can just succeed when passwords are reused on multiple accounts. When a unique master password is employed for an account, it will be safeguarded against credential stuffing attacks.

Cyberattacks on password managers are fairly unusual and though such an attack can possibly permit a threat actor to gain access to a user’s password vault, password managers remain recommended and could significantly enhance password security. All end users of password managers ought to make sure they pick a long, complicated, and unique password or passphrase for their password manager account. They should use multi-factor authentication. For even more security, consider utilizing the secure password manager’s username generator, when that feature is available.

Onyx Technologies located in Largo, MD, a firm providing IT and Consulting Services and a vendor of Independent Care Health Plan (iCare), lately advised 96,814 health plan members concerning the likely exposure of some of their protected health information (PHI).

Onyx learned on June 28, 2022 that unauthorized persons had accessed its computer systems and may have obtained access to the PHI of iCare members, such as names, birth dates, addresses, telephone numbers, iCare member ID numbers, Medicare ID Numbers, dates of service, and names of the provider.

Onyx stated that an evaluation of its computer networks was quickly carried out, and a security agency helped with the analysis. Systems access was recovered on July 7, 2022. As per Onyx, a server may have been taken out or accessed starting on March 29, 2022 and ending on June 28, 2022. On July 15, 2022, the security company discovered that certain information associated with members might have been viewed.

Onyx mentioned it didn’t uncover any proof that indicates any of the impacted data was identified. Impacted persons were provided complimentary two-year credit monitoring and identity theft protection services.

27,367 Individuals Affected by San Diego American Indian Health Center Breach

San Diego American Indian Health Center has informed 27,367 present and past patients that unauthorized people acquired access to areas of its network and exfiltrated files that contain some of their PHI.

The health center discovered the security breach on May 5, 2022, and took prompt steps to safeguard the system and avoid further unauthorized access. The investigation by a digital forensics agency affirmed on July 22, 2022 the compromise of patient information, such as names, driver’s license numbers, state identification card numbers, tribal ID card numbers, medical details, medical insurance data, dates of birth, and Social Security numbers.

San Diego American Indian Health Center stated it is not aware of any actual or attempted misuse of patient data. Impacted persons have been given free credit monitoring and identity protection services and action had been undertaken to strengthen security to stop more data breaches.

New Jersey Department of Health Warns Patients Concerning Vendor Data Breach

The New Jersey Department of Health, Division of Behavioral Health Services lately reported on the theft of the protected health information of a number of patients of Trenton Psychiatric Hospital and the Anne Klein Forensic Center in a security incident that occurred at a vendor offering the hospitals medical translation and dictation services.

Unauthorized people obtained access to sections of the vendor’s systems and extracted files that contained the PHI of patients. The vendor advised the NJ Department of Health concerning the information breach on June 30, 2022. It is presently unclear which vendor was affected, the types of data exposed, and the number of persons impacted by the data breach. The affected hospitals will inform the patients directly when they are impacted.

There is a noticeable increase in the number of healthcare providers that have enforced zero trust initiatives, as reported by Okta in its 2022 State of Zero Trust Security report. In 2022, 58% of surveyed companies said they had or have begun employing zero trust initiatives, up by 21 percentage points from the 37% a year ago. Moreover, 96% of all healthcare respondents stated they either had or are preparing to use zero trust within the next 12 to 18 months, higher than 91% last year.

The traditional method of security considers devices and apps within the network perimeter as trusted since they are behind the security of perimeter defenses; nonetheless, that strategy does not do well in the cloud, where there is no perimeter to secure. The concept of zero trust is, “never trust, always verify”. Zero trust presumes that every device and account might be malicious, irrespective of whether it is inside or outside the network perimeter. With zero trust, every device, account, application, and connection are subject to tough authentication inspections, the principle of least privilege is applied, and there’s extensive security checking.

Okta explained that “Zero Trust is a sound guiding rule, but getting there is a complicated proposition, needing several deeply integrated best-of-breed solutions working easily together. Every organization has a distinct starting situation, diverse resources, and different priorities, leading to unique journeys to get to a similar destination-true Zero Trust security.

Adopting Zero Trust in Healthcare

There’s been a substantial growth in medical and IoT devices, programs, and cloud-based tools, which has considerably expanded the attack surface. Therefore, security teams find it more challenging to protect against cyberattacks utilizing traditional protection strategies. Zero trust provides a solution and most healthcare providers that have not yet used zero trust initiatives state they have a plan in place to use zero trust in the following 6 to 12 months.

98% of healthcare survey participants mentioned identity has a significant part in their zero trust strategy, with 72% rating it essential and 27% rating it critical, with the most urgent projects using Single Sign-on for workers and securing access to APIs. Presently, merely 6% of healthcare respondents stated they have context-based access policies set up. However 40% mentioned they will be rolling these out within the upcoming 12-18 months, and all healthcare participants considering using SSO, MFA, or both for SaaS applications, internal programs, and servers in the following 12-18 months.

The most crucial factors for managing and enhancing access to internal resources were the following: device trust, geographic area, and trusted IP address, then the time of day or working hours-based access, and if the resource seeking to be accessed is very sensitive. Healthcare companies are likewise shifting away from password-based authentication. Use of passwords declined from 94% of healthcare providers in 2021 to 85% in 2022, as push authentication use increased from 16% in 2021 to greater than 40% in 2022.

Okta explained that usage of a Zero Trust framework offers a strategy that makes it less difficult for firms to continuously evaluate their security posture and the relative maturity of their model, and identify the appropriate security options to speed up their progress at each stage of their journeys. Nevertheless, there are difficulties for healthcare companies, and the most important is the present talent and skill scarcity. In view of the talent/skill deficiency experienced worldwide, organizations must find options that help them move along their Zero Trust journeys without creating the need for extra finances, headcount, or training resources. They have to find solutions that integrate with their current security ecosystems to acquire the best value.

Congressman Mike Gallagher (R-WI) and Senator Angus S. King Jr. (I-ME), Co-Chairs of the Cyberspace Solarium Commission, wrote to Secretary Xavier Becerra of HHS, to express their fears regarding the insufficiency of disclosing actionable threat data with industry associates to aid the health and public health sector (HPH) deal with present cybersecurity issues.

The lawmakers mentioned in the letter that the COVID-19 pandemic showed a number of the systemic problems confronting the HPH sector, and at that time when healthcare personnel was coping with amplified workforce problems, cybercriminals and nation-state threat actors attacked the HPH industry and ransomware attacks exploded.

They say cyber threat actors found that the HPH industry was more likely to give ransom payments to maintain patient privacy and the big volumes of sensitive patient information are kept by healthcare suppliers making them appealing targets for scammers and nation-state attackers. The lawmakers lauded the work of the White House and the HHS on bettering cybersecurity in the HPH industry yet are worried about the deficiency of solid and timely disclosure of actionable threat data with industry associates. They mentioned it is necessary to considerably increase the Department’s abilities and resources because of the exponential increase of cyber threats, and that it is necessary to prioritize dealing with the HPH sector’s cybersecurity issues.

King and Gallagher have asked for the HHS Secretary’s briefing to talk about the standing of the department’s attempts to reinforce its capabilities and operationalize ventures with companies throughout the HPH industry. That is only feasible to perform effective oversight when they know the problems that the HHS and the HPH industry are dealing with.

Particularly, they have asked for data about the present organizational framework, roles, and duties that the HHS uses to help HPH cybersecurity and work as the Sector Risk Management Agency (SRMA) for the whole HPH.

• The present authorities – the HHS needs to boost the cybersecurity of the HPH industry
• The resources, such as employees and budget – the HHS needs to be an efficient SRMA
• The interagency coordination structures employed to help the HHS’s efforts and the cybersecurity work of the HPH industry, the achievements reached, and the challenges encountered.

The lawmakers have additionally asked for an unclassified threat report from the HHS on present cybersecurity threats to the HPH industry.

The U.S. Cybersecurity and Infrastructure Security Agency has released a listing of the top malware variants discovered in 2021. Threat actors use malware to attack devices, allowing them an entry point into devices and systems to do a variety of nefarious activities. Malware is detrimental to sabotage systems, for instance, wipers that erase all information in systems. The surge in the price of cryptocurrencies resulted in a growth in the usage of cryptocurrency miners that hijack the information of systems for mining cryptocurrencies. Worms and other malware can breach one device and likewise self-propagate and affect all other vulnerable gadgets on a system.

Recently, the use of ransomware greatly increased. Ransomware encrypts data on attacked systems to make information inaccessible. Ransom demand is sent to the victim in exchange for the decryption keys. The majority of ransomware variants support information exfiltration. Before encryption, files are stolen. The ransom payment should then be given to decrypt files and also to stop the public posting or sale of the stolen information. Although ransomware is a kind of malware, it is usual for threat actors to use it like the Remote Access Trojans (RATs) to obtain preliminary access to systems, and sell the access to ransomware groups.

Malware is downloaded utilizing different attack vectors. Malware is often sent through email, upon the exploitation of vulnerabilities in Remote Desktop Protocol, and by taking advantage of identified vulnerabilities in software programs. Preliminary access to accounts may be obtained by using brute force tactics to figure out weak credentials. Because of different attack vectors, there is no one cybersecurity control that could be employed to prevent all malware attacks. It must additionally be mentioned that although antivirus software program can identify malware according to malware signatures available in the definition lists of the software program, it can’t prohibit malware except if the signature is found in the definition list. Different variants of malware are launched, and small adjustments could be all that are needed to avert antivirus remedies.

In 2021, the most popular types of malware employed in attacks are banking Trojans, remote access Trojans, malware, and information stealers. The leading malware variants were:

Information Stealers – Agent Tesla, AZORult, Formbook, NanoCore
Information Stealer and Banking Trojan – Ursnif
Trojon Information Stealer – LokiBot
Ransomware dropper – MOUSEISLAND
Banking Trojan – Qakbot – This is often utilized for reconnaissance and information exfiltration, and sending more malware payloads
Remcos – Remote management and pen testing tool employed to develop a backdoor in system of victims
Banking Trojan cum botnet cum malware dropper – TrickBot
Malware loader – GootLoader

These malware variants have been employed in attacks for many years and have progressed to become more elusive and offer them new functionality. AZORult, Agent Tesla, Formbook, NanoCore, LokiBot, TrickBot, and Remcos have all been employed for over 5 years, whereas Qakbot and Ursnif have been used for over 10 years.

Besides giving malware gangs access to victims’ systems, TrickBot and Qakbot work as malware droppers and were broadly employed to provide ransomware groups such as Conti with systems access. The Conti group is recognized to have performed a minimum of 450 ransomware attacks in the first 6 months of 2021. All through 2021, the malware variants Agent Tesla, Formbook, and Remcos were substantially used in phishing emails, exploiting the pandemic and making use of COVID-19-inspired baits.

Mitigations

CISA has given a listing of proposed mitigations for preventing malware threats and minimizing the effect of successful attacks, the most critical of which are to update software programs and patch immediately, implement multifactor authentication, protect and keep track of RDP and other possibly dangerous services, and give consumer security awareness instruction.

SonicWall has updated its mid-year 2022 Cyber Threat Report, which shows the worldwide cyberattack developments in H1 of 2022. The information for the report was gathered from over 1.1 million worldwide sensors in 215 nations and reveals a global drop in ransomware attacks, with a significant rise in malware attacks. This trend is a first in three years.

Ransomware

SonicWall states a 23% drop in ransomware attacks worldwide in H1 of 2022 with only 236.1 million attempted attacks. The downhill trend continues for the past four quarters. The lowest number of ransomware attacks was in June 2022. Although ransomware attacks decreased overall, that isn’t true for the healthcare sector with 328% higher attacks in H1 2022.

Although the decrease in attacks is good news, it ought to be mentioned that the year-to-date numbers of ransomware attacks continue to be greater than in 2017, 2018, and 2019. SonicWall documented 707 ransomware attempts on average per client in the first half of 2022 in the U.S.A. SonicWall states that the reduction in attacks is due to the mix of geopolitical forces, unpredictable cryptocurrency rates, and a greater government and law-enforcement emphasis on ransomware groups.

Malware

Ransomware attacks had grown for two years, however, malware attacks are at low figures. 2021 had the lowest malware attacks in 7 years. H1 2022 saw a sharp rise in malware attacks. It is 11% more compared to H1 2021. There were 2.8 billion malware attacks in H1 2022 with 8,240 attempts on average per customer. There was a noticeable increase in new malware variants in 2022, which grew by 45% compared to H1 2021. Cryptojacking has grown by 30% in comparison to H1 2021, despite the sharp drop in the price of cryptocurrencies. Cryptjacking attacks in healthcare dropped by 87%.

The largest upsurge in malware was observed in IoT malware, which grew by 77% from H1 2021 having 57 million detections. That is the maximum rate of detection since SonicWall started tracking the attacks. The number of attacks in H1 2022 was just somewhat less than the total attacks documented in 2021. IoT attacks in America grew by 228% in June while IoT malware attacks on the healthcare sector grew by 123%.

Malicious Files

SonicWall revealed in its mid-year 2021 report that the number of malicious Office files dropped by 54% and malicious PDF files dropped by 13%. However, the decrease in number was brief, as this year saw a boost in detections of malicious files. In the H1 of 2022, malicious Office file detections went up by 18%, while malicious PDF file detections grew by 9%. Currently, 18% of malicious file types are PDF files, while 10% are Office files and over 84% are Excel files. 64% of malicious Excel files are Excel Macro 4.0 (XLM) files. Executable files remain the most popular malicious file types, with over 33% of malicious files.

Encrypted Attacks

SonicWall noticed a 132% rise in encrypted attacks in H1 2022, which is a continuation of the past two years’ trends. May 2022 had the second highest number of malware over HTTPS ever documented. Encrypted threats were most common in the U.S., which is 41% of the worldwide volume, having a 284% growth over the equivalent period in 2021. There was a 6% drop in encrypted attacks in healthcare.

Intrusion Attempts

Intrusion attempts increased by 18% worldwide in H1 2022, however, the number of malicious intrusions dropped by 19%. In North America, there was a rise in intrusion attempts yet the attacks seem to have reached the maximum in June. Intrusion attempts grew by 39% in the healthcare sector, 46% in government, and 200% in the retail industry. Despite these surges, the H1 2022 statistics are less than in 2021.

The majority of Americans are certain regarding their knowledge of cybersecurity based on a newly released AT&T survey of 2,000 Americans. However, bad cyber hygiene and poor password routines continue to be prevalent. OnePoll conducted the survey on behalf of AT&T and discovered that 70% of respondents felt they were proficient concerning cybersecurity with 69% stating they were assured in their capability to be able to recognize suspicious websites quickly, but the typical person still lands on a suspicious online page or social media page 6.5 times a day.

When asked about Internet use, merely 39% of participants claimed they knew that online sites could download malware to their computers and merely 45% stated they were aware that suspicious websites can bring about identity theft. 54% did not know the difference between an active threat – one that demands some user action – and an inactive threat – where a device is attacked without any activity from the user.

Though thinking they could distinguish suspicious online sites, for example, unverified internet sites, HTTP sites, and websites having a lot of pop-ups, the potential security threats from accessing those internet sites were frequently overlooked. 38% of respondents stated they go to those websites for streaming sporting events, 37% utilize the internet sites to download music and video games that are not easy to get, and 36% reported they would check out those sites if they have good discounts on purchases.

The risks due to bad cybersecurity practices are not only theoretical. Poor cyber hygiene is taken advantage of by threat actors and often allows compromise of accounts. When asked about threat experiences, 45% of respondents mentioned they had received a telephone call from somebody saying to be from the government and 36% of participants mentioned they would reply to communication if it looked like it came from an official company.

Under 40% of people consider the security problems of accessing the Web such as potential device or network attacks, malicious applications, or malware downloads. The number of survey respondents affected by password security risks is worrying. One of the biggest password security errors is utilizing the same password on several accounts. When passwords are obtained during a data breach of an organization, a credential stuffing attack may be done that would permit access to every account where that password has been utilized. 42% of survey respondents mentioned they reuse passwords across various accounts.

The best practice for creating passwords is to utilize a mix of numbers, upper and lower-case letters, and symbols, and to refrain from using personal data in passwords. 31% of participants confessed they use their birthday as their password, although many people will know the details and even find it on social media profiles pages. The survey additionally revealed that 34% of men and women are reactive and not proactive with regards to password security, and would just modify a password if they receive a security advisory regarding an attempt to access their account via an unrecognized IP address. These bad password practices continue even if a lot of people assert they know about cybersecurity, and password managers are extensively offered for free or at a low price that can significantly enhance password security.

These bad cyber practices ought to be a concern for companies. In case individuals are lax concerning personal security in spite of knowing the threats of identity theft and fraud, it is probable that those poor practices may likewise happen at work. Employers must make sure they offer regular security awareness training to show their workers how taking risks like these could put the company in danger.