Trustwave, a leading cybersecurity and managed security services provider, today released comprehensive research shedding light on the distinctive cybersecurity risks encountered by the healthcare sector. The report, “Cybersecurity in the Healthcare Industry: Actionable Intelligence for an Active Threat Landscape,” explores the specific threats and risks that healthcare organizations face, along with practical insights and mitigations to strengthen their defenses.
In an era where cyber threats continue to evolve, healthcare organizations are increasingly targeted by malicious actors employing multiple attack vectors. In its new research, Trustwave SpiderLabs has documented the attack flow utilized by threat groups, shedding light on their tactics, techniques, and procedures. From phishing emails to exploiting known vulnerabilities and compromising third-party vendors, these persistent threats pose significant risks to the industry.
While the healthcare industry is not alone in facing an elevated threat landscape, the consequences of attacks in this sector can be severe, even fatal. Adversaries are highly motivated by financial gains and continuously refine their techniques to surpass existing defenses. In 2022, the average cost of a data breach in healthcare was $10.1 million, which is more than double the industry average of $4.4 million, according to data from the Ponemon Institute.
“Protecting the supply chain and maintaining business continuity are critical considerations across most industries, but healthcare cyber leaders encounter distinct challenges in safeguarding patient well-being, maintaining quality of care, and enabling healthcare professionals to leverage cutting-edge digital technologies to perform at the highest level,” said Trustwave Chief Information Security Officer Kory Daniels. “Our latest threat briefing is a valuable resource for security leaders within the healthcare sector, providing a comprehensive view of the threats observed by our SpiderLabs team, along with specific mitigation strategies to bolster defenses.”
The Trustwave SpiderLabs report analyzes threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. These methods encompass leveraging valid access credentials, exploiting unsecured credentials, and utilizing Webshells. Additionally, the report identifies specific entry points such as Apache Log4J (CVE-2021-44228) and Spring Core RCE (CVE-2022-22965) vulnerabilities, while highlighting the high activity of prominent ransomware gangs like LockBit and ALPHV/BlackCat targeting healthcare entities.
Trustwave SpiderLabs’ research serves as a resource for healthcare organizations to understand and combat the multitude of attack groups, malware variants, and techniques deployed against them. The report explores:
Emerging and Prominent Trends in the Healthcare Industry
- Artificial Intelligence and Generative AI: Unique implications and risks due to the sensitive nature of the data potentially being shared with these tools.
- Ransomware Groups Targeting Healthcare: Threat groups previously considered healthcare-related targets off limits, or protected, but are now widely attacked.
- Software Vendor and Internet of Things (IoT) Exposure: The risks associated with third-party vendors and the proliferation of Internet of Things (IoT) devices in healthcare further amplifies the potential attack surface and vulnerability of the industry’s infrastructure.
Cybersecurity Challenges Unique to the Healthcare Industry
- Custom Applications: Healthcare organizations rely heavily on custom applications that often lack adequate security testing and code auditing, leading to undiscovered vulnerabilities.
- Third Party Reliance: Healthcare entities commonly engage with numerous third parties, further expanding the number of endpoints and users involved, thereby contributing to a growing threat surface.
- Internet of Things: The healthcare industry typically has a higher number of connected physical devices, such as heart monitors and imaging hardware, which often prioritize functionality over software security.
- Compliance: Healthcare organizations are often hesitant to implement changes quickly due to concerns about compliance with oversight agencies and compatibility issues with existing software and hardware.
- Patient Care: The focus on patient safety and avoiding unexpected disruptions, like system crashes, leads healthcare organizations to be more cautious about adopting software patches or making changes that could jeopardize patient care.
Prevalent Threat Actors and Threat Tactics Operating Across Healthcare
Threat Actors:
- LockBit 3.0
- ALPHV/BlackCat
- Clop
- DMA Locker
- Royal
- Babuk
- Magniber
- Black Basta
- RansomHouse
Threat Tactics
- Phishing/BEC
- Vulnerability Exploitation
- Logging In with Valid Credentials
(Unsecured, Default, Low Complexity, or Purchased) - Existing Tools (Powershell, LOLBins)
- Webshells and Stolen Sessions
- Malware (Infostealers, RATs, Ransomware)
- DDoS
To access the full Trustwave SpiderLabs threat report, “Cybersecurity in the Healthcare Industry: Actionable Intelligence for an Active Threat Landscape,” please click here.
