{"id":599829,"date":"2023-01-21T12:49:41","date_gmt":"2023-01-21T18:49:41","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/01\/21\/hc3-warns-of-clop-ransomware-targeting-medical-images\/"},"modified":"2023-01-21T12:49:41","modified_gmt":"2023-01-21T18:49:41","slug":"hc3-warns-of-clop-ransomware-targeting-medical-images","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/01\/21\/hc3-warns-of-clop-ransomware-targeting-medical-images\/","title":{"rendered":"HC3 warns of Clop ransomware targeting medical images"},"content":{"rendered":"
\n

The Health Sector Cybersecurity Coordination Center said in its latest analysis that the Clop ransomware gang has shifted tactics, directly impacting the healthcare and public health sector.\u00a0<\/p>\n

New baiting tactics for ransomware gang\u00a0<\/strong><\/p>\n

While Clop ransomware has been around since 2019 and experienced several arrests, the ransomware-as-a-service operation has had difficulties getting victims to pay the ransom.\u00a0<\/p>\n

HC3, which released several ransomware warnings in 2022, including one about the\u00a0exceptionally aggressive Hive ransomware<\/a>\u00a0that seeks to delete healthcare data backups, says that Clop has been infecting files and disguising them to look like medical documents to be reviewed.<\/p>\n

They are “submitting them to facilities, and then requesting a medical appointment in hopes of those malicious documents being opened and reviewed beforehand,” the agency said in the\u00a0analysis<\/a>.<\/p>\n

“These attacks have a higher chance of working due to conditions from COVID-19 expansion in the telehealth environment.”<\/p>\n

The agency also indicates that Clop, or CLOp, targets Windows and sends phishing emails to gain entry.\u00a0It’s also known to have resistance to anti-analysis virtual-machine analysis.\u00a0<\/p>\n

After files are encrypted, they drop a ransom note saying that the stolen files will be deleted after two weeks.<\/p>\n

Targeting telehealth<\/strong><\/p>\n

Medical providers continue to expand telehealth to increase access, improve care and reach more patients \u2013 and\u00a0revenues are high<\/a>.<\/p>\n

Last month KrebsOnSecurity reported about Clop after seeing an intercepted communication in which the group indicated it was successful in infiltrating new victims by disguising ultrasound images and other medical documents.<\/p>\n

In the\u00a0report<\/a>, Alex Holden, founder of Hold Security, a Milwaukee-based cybersecurity firm, said the group is strategically targeting the types of medical conditions they perceive to be more easily diagnosed via telehealth.<\/p>\n

“Basically, they\u2019re counting on doctors or nurses reviewing the patient\u2019s chart and scans just before the appointment,” Holden said.\u00a0<\/p>\n

“They initially discussed going in with cardiovascular issues, but decided cirrhosis or fibrosis of the liver would be more likely to be diagnosable remotely from existing test results and scans.”<\/p>\n

Andrea Fox is senior editor of Healthcare IT News.
\nEmail:\u00a0af**<\/span>@***<\/span>ss.org<\/span><\/a><\/em>
Healthcare IT News is a HIMSS publication.<\/em><\/p>\n<\/div>\n

Read More<\/a>
\n Alejandro Mote<\/p>\n","protected":false},"excerpt":{"rendered":"

The Health Sector Cybersecurity Coordination Center said in its latest analysis that the Clop ransomware gang has shifted tactics, directly impacting the healthcare and public health sector.\u00a0 New baiting tactics for ransomware gang\u00a0 While Clop ransomware has been around since 2019 and experienced several arrests, the ransomware-as-a-service operation has had difficulties getting victims to pay<\/p>\n","protected":false},"author":1,"featured_media":599830,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31358,359],"tags":[],"class_list":{"0":"post-599829","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-ransomware","8":"category-warns"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/599829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=599829"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/599829\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/599830"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=599829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=599829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=599829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}