Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
News Releases

Trustwave Releases New SpiderLabs Research Focused on Actionable Cybersecurity Intelligence for the Healthcare Industry

Chicago – July 13, 2023 – Trustwave, a leading cybersecurity and managed security services provider, today released comprehensive research shedding light on the distinctive cybersecurity risks encountered by the healthcare sector. The report, "Cybersecurity in the Healthcare Industry: Actionable Intelligence for an Active Threat Landscape," explores the specific threats and risks that healthcare organizations face, along with practical insights and mitigations to strengthen their defenses.

In an era where cyber threats continue to evolve, healthcare organizations are increasingly targeted by malicious actors employing multiple attack vectors. In its new research, Trustwave SpiderLabs has documented the attack flow utilized by threat groups, shedding light on their tactics, techniques, and procedures. From phishing emails to exploiting known vulnerabilities and compromising third-party vendors, these persistent threats pose significant risks to the industry.

While the healthcare industry is not alone in facing an elevated threat landscape, the consequences of attacks in this sector can be severe, even fatal. Adversaries are highly motivated by financial gains and continuously refine their techniques to surpass existing defenses. In 2022, the average cost of a data breach in healthcare was $10.1 million, which is more than double the industry average of $4.4 million, according to data from the Ponemon Institute.

“Protecting the supply chain and maintaining business continuity are critical considerations across most industries, but healthcare cyber leaders encounter distinct challenges in safeguarding patient well-being, maintaining quality of care, and enabling healthcare professionals to leverage cutting-edge digital technologies to perform at the highest level,” said Trustwave Chief Information Security Officer Kory Daniels. "Our latest threat briefing is a valuable resource for security leaders within the healthcare sector, providing a comprehensive view of the threats observed by our SpiderLabs team, along with specific mitigation strategies to bolster defenses.”

The Trustwave SpiderLabs report analyzes threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. These methods encompass leveraging valid access credentials, exploiting unsecured credentials, and utilizing Webshells. Additionally, the report identifies specific entry points such as Apache Log4J (CVE-2021-44228) and Spring Core RCE (CVE-2022-22965) vulnerabilities, while highlighting the high activity of prominent ransomware gangs like LockBit and ALPHV/BlackCat targeting healthcare entities.

Trustwave SpiderLabs’ research serves as a resource for healthcare organizations to understand and combat the multitude of attack groups, malware variants, and techniques deployed against them. The report explores:

Emerging and Prominent Trends in the Healthcare Industry

  • Artificial Intelligence and Generative AI: Unique implications and risks due to the sensitive nature of the data potentially being shared with these tools.
  • Ransomware Groups Targeting Healthcare: Threat groups previously considered healthcare-related targets off limits, or protected, but are now widely attacked.
  • Software Vendor and Internet of Things (IoT) Exposure: The risks associated with third-party vendors and the proliferation of Internet of Things (IoT) devices in healthcare further amplifies the potential attack surface and vulnerability of the industry's infrastructure.

Cybersecurity Challenges Unique to the Healthcare Industry

  • Custom Applications: Healthcare organizations rely heavily on custom applications that often lack adequate security testing and code auditing, leading to undiscovered vulnerabilities.
  • Third Party Reliance: Healthcare entities commonly engage with numerous third parties, further expanding the number of endpoints and users involved, thereby contributing to a growing threat surface.
  • Internet of Things: The healthcare industry typically has a higher number of connected physical devices, such as heart monitors and imaging hardware, which often prioritize functionality over software security.
  • Compliance: Healthcare organizations are often hesitant to implement changes quickly due to concerns about compliance with oversight agencies and compatibility issues with existing software and hardware.
  • Patient Care: The focus on patient safety and avoiding unexpected disruptions, like system crashes, leads healthcare organizations to be more cautious about adopting software patches or making changes that could jeopardize patient care.

Prevalent Threat Actors and Threat Tactics Operating Across Healthcare

Threat Actors:

  • LockBit 3.0
  • ALPHV/BlackCat
  • Clop
  • DMA Locker
  • Royal
  • Babuk
  • Magniber
  • Black Basta
  • RansomHouse

Threat Tactics

  • Phishing/BEC
  • Vulnerability Exploitation
  • Logging In with Valid Credentials

(Unsecured, Default, Low Complexity, or Purchased)

  • Existing Tools (Powershell, LOLBins)
  • Webshells and Stolen Sessions
  • Malware (Infostealers, RATs, Ransomware)
  • DDoS

To access the full Trustwave SpiderLabs threat report, "Cybersecurity in the Healthcare Industry: Actionable Intelligence for an Active Threat Landscape," please click here.

About Trustwave

As a recognized global cyber defender that stops cyber threats all day, every day – we enable our clients to conduct their business securely.

Trustwave detects threats that others can’t see, enabling us to respond quickly and protect our clients from the devastating impact of cyberattacks. We leverage our world-class team of security consultants, threat hunters and researchers, and our market-leading security operations platform to relentlessly identify and isolate threats with the right telemetry at the right time for the right response.

Trustwave is a leader in managed detection and response (MDR), managed security services (MSS), consulting and professional services, database security, and email security. Our elite Trustwave SpiderLabs team provides award-winning threat research and intelligence, which is infused into Trustwave services and products to fortify cyber resilience in the age of advanced threats.

For more information about Trustwave, please visit our website.

Latest News Releases

New Trustwave SpiderLabs Research Exposes Unique Cybersecurity Threats Facing Education Industry

Chicago – February 22, 2024 – Trustwave, a leading cybersecurity and managed security services provider, today released comprehensive research uncovering unique cybersecurity threats faced by...

Read More

Trustwave MailMarshal Now Available on Microsoft Azure Marketplace

Chicago – February 1, 2024 – Trustwave, a global cybersecurity and managed security services leader, today announced the availability of Trustwave MailMarshal on the Microsoft Azure Marketplace, an...

Read More

Aquion and Trustwave Announce Strategic Partnership to Boost Cybersecurity in Australia and New Zealand

Sydney, Australia - Jan 30, 2024 - Aquion, a specialist in value-added software distribution, proudly announces its strategic partnership with global managed cybersecurity leader Trustwave. This...

Read More