Trustwave uncovers the truth about healthcare sector cybersecurity risks

Trustwave, a cybersecurity and managed security services provider, has released comprehensive research shedding light on the distinctive cybersecurity risks encountered by the healthcare sector.

The report, "Cybersecurity in the Healthcare Industry: Actionable Intelligence for an Active Threat Landscape," explores the specific threats and risks that healthcare organisations face, along with practical insights and mitigations to strengthen their defences.

In an era where cyber threats continue to evolve, healthcare organisations are increasingly targeted by malicious actors employing multiple attack vectors, Trustwave finds.

In its new research, Trustwave SpiderLabs has documented the attack flow utilised by threat groups, shedding light on their tactics, techniques, and procedures. From phishing emails to exploiting known vulnerabilities and compromising third-party vendors, these persistent threats pose significant risks to the industry.

While the healthcare industry is not alone in facing an elevated threat landscape, the consequences of attacks in this sector can be severe, even fatal, according to the researchers.

Adversaries are highly motivated by financial gains and continuously refine their techniques to surpass existing defences. In 2022, the average cost of a data breach in healthcare was US$10.1 million, which is more than double the industry average of US$4.4 million, according to data from the Ponemon Institute.

Kory Daniels, Chief Information Security Officer, Trustwave, comments, "Protecting the supply chain and maintaining business continuity are critical considerations across most industries, but healthcare cyber leaders encounter distinct challenges in safeguarding patient well-being, maintaining quality of care, and enabling healthcare professionals to leverage cutting-edge digital technologies to perform at the highest level."

Trustwave's latest threat briefing is a valuable resource for security leaders within the healthcare sector, providing a comprehensive view of the threats observed by the company's SpiderLabs team, along with specific mitigation strategies to bolster defences.

The Trustwave SpiderLabs report analyses threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. These methods encompass leveraging valid access credentials, exploiting unsecured credentials, and utilising Webshells.

Additionally, the report identifies specific entry points such as Apache Log4J (CVE-2021-44228) and Spring Core RCE (CVE-2022-22965) vulnerabilities, while highlighting the high activity of prominent ransomware gangs like LockBit and ALPHV/BlackCat targeting healthcare entities.

Trustwave SpiderLabs research serves as a resource for healthcare organisations to understand and combat the multitude of attack groups, malware variants, and techniques deployed against them. The report explores:

Emerging and prominent trends in the healthcare industry

• Artificial intelligence (AI) and generative AI: Unique implications and risks due to the sensitive nature of the data potentially being shared with these tools.
• Ransomware groups targeting healthcare: Threat groups previously considered healthcare-related targets off limits, or protected, but are now widely attacked.
• Software vendor and Internet of Things (IoT) exposure: The risks associated with third-party vendors and the proliferation of Internet of Things (IoT) devices in healthcare further amplifies the potential attack surface and vulnerability of the industry's infrastructure.

Cybersecurity challenges unique to the healthcare industry

• Custom applications: Healthcare organisations rely heavily on custom applications that often lack adequate security testing and code auditing, leading to undiscovered vulnerabilities.
• Third party reliance: Healthcare entities commonly engage with numerous third parties, further expanding the number of endpoints and users involved, thereby contributing to a growing threat surface.
• Internet of Things: The healthcare industry typically has a higher number of connected physical devices, such as heart monitors and imaging hardware, which often prioritise functionality over software security.
• Compliance: Healthcare organisations are often hesitant to implement changes quickly due to concerns about compliance with oversight agencies and compatibility issues with existing software and hardware.
• Patient care: The focus on patient safety and avoiding unexpected disruptions, like system crashes, leads healthcare organisations to be more cautious about adopting software patches or making changes that could jeopardise patient care.

Prevalent threat actors and threat tactics operating across healthcare

Threat actors:

LockBit 3.0; ALPHV/BlackCat; Clop; DMA Locker; Royal; Babuk; Magniber; Black Basta; and RansomHouse.

Threat tactics:

Phishing/BEC; Vulnerability Exploitation; Logging In with Valid Credentials; (Unsecured, Default, Low Complexity, or Purchased); Existing Tools (Powershell, LOLBins); Webshells and Stolen Sessions; Malware (Infostealers, RATs, Ransomware); and DDoS.