The Covid-19 Pandemic Reveals Ransomware’s Long Game

person on stretcher inside of an hospital - Photograph: Robert Nickelsberg/Getty Images

The Covid-19 Pandemic Reveals Ransomware’s Long Game
WIRED, April 28, 2020
Security
By Lily Hay Newman

“Hackers laid the groundwork months ago for attacks. Now they’re flipping the switch.”

 

The novel coronavirus pandemic has stretched the world’s health care systems to their limits, creating a global crisis. New research from Microsoft shows that ransomware attackers are actively making that crisis worse, forcing health care and critical infrastructure organizations to pay up when they can least afford downtime. In many cases, hackers are reaping the rewards of groundwork they laid months ago, before Covid-19 fully hit.

 

Hackers have known for years that hospitals and other health care providers make perfect targets for ransomware attacks, since there’s life-or-death urgency in getting back up and running quickly. During the pandemic, though, the risk has become even more dire. After a hospital in the Czech Republic was hit by a debilitating ransomware attack in March, the country’s cybersecurity oversight agency warned two weeks ago that it was bracing for widespread cyberattacks against critical services in the country. Two Czech hospitals reported attempted attacks a day later, and the US State Department threatened consequences if the antagonism continued.

 

The Czech incidents reflect just one corner of a worrying global trend of opportunistic ransomware activations.

 

“The attackers are definitely being what I’ll call rational economic actors, which unfortunately also means vicious,” says Rob Lefferts, corporate vice president of Microsoft 365 security. “We see behavior where they will break into organizations and actually lie dormant, both because they’re doing reconnaissance but also because they are apparently estimating what is the moment in time when that organization will be most vulnerable and most likely to pay.”

 

An initial attack might give hackers access to a victim’s network. But they’ll then wait weeks or months for a particularly opportune moment to actually infect the system with ransomware. Microsoft has been tracking such behavior from groups using a number of prominent strains of ransomware, like Robbinhood, Maze, and REvil. While some ransomware groups had pledged not to attack hospitals during the coronavirus crisis, in practice hackers are increasingly attempting to cash in.

Read the Full Article »

About the Author:

Lily Hay Newman is a senior writer at WIRED focused on information security, digital privacy, and hacking. She previously worked as a technology reporter at Slate magazine and was the staff writer for Future Tense, a publication and project of Slate, the New America Foundation, and Arizona State University. Additionally her work has appeared in Gizmodo, Fast Company, IEEE Spectrum, and Popular Mechanics. She lives in New York City.

See also: