The Color Of Espionage Is Orange

Have you heard about that new creature worming its way around the healthcare industry? Well, it’s orange and it’s a worm. According to security company, Symantec, it’s not harmless. It’s performing some serious espionage. It’s really a group and is being dubbed Orangeworm. It’s spreading the malware called Kwampirs onto networks of healthcare providers and related companies. This group is not out to grab the low-hanging fruit either. It’s carefully selecting targets and is doing its homework on the planning phase too.

While it isn’t limiting the attacks to those in or related to healthcare, those organizations do make up about 40% of its targets. Other areas are manufacturing, information technology, and an unknown segment all with 15% and logistics and agriculture organizations at 8%. These are believed to be all somehow connected to the healthcare companies by providing products and/or services to them.

In the case of healthcare, it was found on machines that interact with other medical devices, such as MRI machines and high-tech imaging machines, like X-Rays. It was also found on machines that patients use to provide consent. There is no evidence that patient details were being sought. It’s more a very deliberate campaign to gain industry-related knowledge and information.

Those in the healthcare world, weather in the U.S. or anywhere else, should be aware of this and other malware that can hit devices. In many cases, cybercriminals take advantage of vulnerabilities in software and hardware because the devices haven’t been updated. A lot of companies connected to the healthcare industry use outdated operating systems and other software, such as Windows XP. These have known issues that Orangeworm and others like it exploit. Windows XP and previous versions of Windows haven’t been supported in several years. If you are still using this system, seriously consider upgrading to a supported version. When a developer discontinues support, it ceases to provide patches for issues.  These are the opportunities the criminals pounce on.

In addition, be sure to remind users to always be on the lookout for phishing attempts. These arrive by way of email messages, usually, but can also be in the form of text messages, SMS, or phone calls.

Once Kwampirs is on a network, it installs a backdoor. This provides the attackers with remote access to the computers and network. This backdoor is used to infect other devices and collect information about the organization, which gets sent back to Orangeworm.

This group is not limiting attacks to a single nation either and does not appear to be state-sponsored. It has hit organizations in the U.S. (17%), but also has been seen in a significant chunk in India and Saudi Arabia. Many other countries are affected as well.

In addition to updating outdated systems, ensure that anti-virus is installed and kept current as well. Symantec also recommends protecting with other security products such as web security service, security analytics, malware analysis, content analysis, an intrusion protection system, as well as other security tools.

According to a report from Citrix Sharefile, there were more than 300 data breaches that hit the healthcare industry in 2017. The cost of these was estimated to be more than $1 billion. WannaCry ransomware contributed to this when it forced hospitals to turn patients away when it infected systems.