Healthcare organizations in the United States are under attack from the Venus ransomware (opens in new tab), the country’s Department of Health and Human Services (HHS) is warning.
In a report published by the Health Sector Cybersecurity Coordination Center (HC3), the HHS states that it is aware of at least one successful Venus attack against a public healthcare firm.
The problem with Venus’ operators, however, is that they’re not the usual double-whammy ransomware group – there is no data leak site, and the operators don’t seem to be interested in leaking the stolen intel online.
No data leak site yet
“The operators of Venus ransomware are not believed to operate as a ransomware-as-a-service (RaaS) model and no associated data leak site (DLS) exists at this time,” the report reads.
Elsewhere in the report, it was said that Venus ransomware most likely started operating in August 2022, and has since encrypted numerous victims all over the globe. BleepingComputer adds that since August, new submissions were being uploaded to ID Ransomware every day, suggesting that the operators are quite active.
The malware works by terminating 39 processes associated with database servers and Microsoft Office applications. It targets publicly exposed Remote Desktop services, using them to gain initial access to the target endpoints (opens in new tab). Besides terminating processes, the ransomware also deletes event logs, Shadow Copy Volumes, and disables Data Execution Prevention.
Healthcare organizations are among the most popular targets for cybercriminals, especially since the outbreak of the coronavirus. Hospitals run countless computers, printers, and internet-connected smart devices, generating thousands of sensitive files. These devices are sometimes outdated and improperly secured, making for an ideal first-entry endpoint.
Furthermore, with the Covid-19 pandemic filling up every last space in hospitals, overworked healthcare workers are an easy target to prey on with phishing and social engineering attacks.
Besides Venus, healthcare organizations in the States were targeted by Maui, Zeppelin, Daixin, Quantum, and many other strains.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba