2,400 Nursing Homes Immobilized in Ransomware Attack
Ostra’s Intrusion Detection Layers Prevent Advanced Persistent Attacks
Cyber criminals found a vulnerable target when they attacked Virtual Care Provider Inc (VCPI). This classic advanced persistent threat began with a breach over a year ago, and in the 14 months after VCPI was first compromised, the groundwork was laid for a full-fledged ransomware infestation. Businesses that don’t have intrusion detection as a part of their cybersecurity strategy are particularly vulnerable to this type of attack.
VCPI faces the long road to recovery when (and if) the attack is brought under control.
The Wisconsin-based company that provides cloud data hosting, security and access management to more than 100 nursing home management companies across the United States is currently crippled by an infection of a ransomware strain known as Ryuk. All data the company hosts for its clients was encrypted on November 17, and core offerings such as Internet service and email, access to patient records, client billing and phone systems across the 2,400 facilities served have all been impacted. VCPI is unable to pay the nearly $14 million ransom demand, and is focused on restoring services to the 80,000 computers and servers that assist those facilities.
While an advanced persistent attack typically stems from an email attachment that is used to download malware, it differs from a traditional attack in a number of ways. Targeted attacks such as these may go undetected because they are specifically designed to avoid detection by signature-based antivirus solutions. The malware in these types of attacks is designed to keep installing itself, establishing persistence and furthering its ability to spread. This type of sophisticated malware also stays in contact with its “command center” (the cyber-criminal masterminding the attack) to receive instructions. This ongoing undetected contact with the infected system allows cybercriminals to slowly compromise the entire network, map out the target’s internal networks, undermine key resources and data backup systems, disable antivirus, run customized scripts, and deploy ransomware. Because the infection is persistent, if the criminals don’t succeed on the first they can just keep trying.
An effective cybersecurity solution can combat an advanced persistent threat because it combines layers of intrusion prevention and intrusion detection. Partner with Ostra’s to protect your business with an Enterprise Grade security solution that detects and halts reconnaissance activity associated with a ransomeware infestation.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
As the name implies, this type of malware works behind the scenes of an infected computer, sniffing out the keystrokes while the system continues to operate normally. The software can steal passwords, take screen shots, record viewed web pages, grab sent emails and instant messages, as well as sensitive financial information such as credit card numbers, PIN codes, and bank accounts. All of this data is sent over the network to a remote computer or web server where the person operating the logging program can retrieve and sell it to third parties for criminal purposes.
Social engineering has propelled Business Email Compromise (BEC) to new heights of scammer success. Cyber-criminals can construct well crafted and highly detailed emails due to the wealth of information they can collect from social media and also purchase on the dark web. In an increasingly digital age of banking, more businesses are falling victim to Business Email Compromise 
Attacks during the same timeframe increased by 118% with “code innovations and a new, much more targeted approach” which greatly increases the damage potential and recovery costs for the intended victim. The majority of targeted ransomware attacks also wipe or encrypt backups, making infections more debilitating and recovery more costly. In a modern day ransom attack, almost half of small to midsize businesses experience at least 8 hours of downtime with the average ransomware incident lasting 6 days. Costs to restore access to critical systems, replace damaged or stolen assets and mitigate brand damage, public relations, legal fees and fines have also sharply increased in recent years. The “attack vector” against Mannings’ company was an email attachment, which is still the source of over 90% of malware delivery. But it is very likely that a modern day attack would be undetectable to traditional signature virus identification because protection is limited to threats with known signatures. Recent industry research found that 80% of observed malware is single use, meaning it is undetectable by traditional signature-based anti-virus solutions.
