Hospitals and medical institutions are being cyber-kidnapped in the middle of the coronavirus pandemic
These days, hospitals around the world are fighting the coronavirus pandemic with little means. Doctors these days face an unprecedented health problem, and they do it with little means. As well, hacker groups they have intensified their attacks on hospital computer networks. These cyberterrorist groups seek to hijack medical institutions and government institutions to demand ransoms and steal information.
According to an investigation conducted by the Palo Alto Networks company, crackers do not make distinctions when it comes to their attacks. Although there are groups that have decided not to attack health institutions, there are others who do not care about everything. Something that only makes it harder for medical professionals.
Hospitals continue to suffer digital kidnapping attempts
Palo Alto Networks does not indicate which institutions are suffering from these attacks. They just mention government departments of health and a medical research university in Canada. Both organizations were reportedly victims of data theft and computer hijacking with the intention of demanding a ransom. The two attacks occurred between March 24 and 26.
Such computer hijackings are initiated by emails containing malware. All the attacks would seek to pretend that they are from the World Health Organization. All the emails would be sent agencies of the health system and the like that are actively fighting the coronavirus.
Inside is attached a file called "20200323-sitrep-63-covid-19.doc". This file runs malicious software that hijacks the system based on the Microsoft CVE-2012-0158 vulnerability. The vulnerability is in Microsoft ListView / TreeView Active Controls within the MSCOMCTL.OCX library.
Thus, the system infected by this binary digital hijacking pings the control server that injects an image that notifies the user of the hijacking. The data on the computer equipment is then encrypted by means of a password with the extension ".locked20". The hijacking software is based on an EDA2 structure, one of the most common.
Interpol is already working to notify all health institutions about these emails and the risk of opening or downloading files from unofficial sources. They also recommend backing up the database on systems without internet connection.
Source: THN
