{"id":7605,"date":"2021-05-24T21:57:19","date_gmt":"2021-05-24T19:57:19","guid":{"rendered":"http:\/\/plus.maciejpiasecki.info\/index.php\/2021\/05\/24\/conti-ransomware-attacked-16-healthcare-organizations-fbi-says\/"},"modified":"2021-05-25T01:54:30","modified_gmt":"2021-05-24T23:54:30","slug":"conti-ransomware-attacked-16-healthcare-organizations-fbi-says","status":"publish","type":"post","link":"https:\/\/plus.maciejpiasecki.info\/index.php\/2021\/05\/24\/conti-ransomware-attacked-16-healthcare-organizations-fbi-says\/","title":{"rendered":"Conti Ransomware Attacked 16 Healthcare Organizations, FBI Says"},"content":{"rendered":"<p>According to the Federal Bureau of Investigation (FBI), Conti ransomware has recently targeted at least 16 healthcare organizations in the United States, including first responder organizations. The FBI has also released a TLP: WHITE to help organizations on defending themselves against future threats.<br \/>\n\u201cThe FBI identified at least 16 Conti ransomware attacks targeting U.S. healthcare and first responder networks, including law enforcement agencies, emergency medical services, 9-1-1 dispatch centers, and municipalities within the last year,\u201d the FBI Cyber Division noted in its announcement. \u201cThese healthcare and first responder networks are among the more than 400 organizations worldwide victimized by Conti, over 290 of which are located in the U.S.\u201d<br \/>\nThe Conti is a Ransomware-as-a-Service (RaaS) that Wizard Spider backs. Wizard Spider believes to be a Russian-based cybercrime group that launches similar attacks on organizations around the world.<br \/>\nThe Conti ransomware can gain access to victim networks through malicious email links, attachments, or stolen RDP credentials.<br \/>\nVictims must pay the amount requested by the attackers within eight days. If victims don\u2019t pay within this period, the attackers will contact the victims via Voice Over Internet Protocol (VOIP) or encrypted emails. The way Conti ransomware works is simple and similar to its other counterparts like Doppelpaymer.<br \/>\nConti ransomware is targeting healthcare organization in the United States and worldwide<br \/>\nThe United States healthcare organization are not the only victims of Conti ransomware. Ireland\u2019s Health Service Executive (HSE) and Department of Health (DoH) faced a similar case that Conti attackers asked for a $20 million ransom.<br \/>\nOf course, the DoH was able to repel the attacks, but the HSE had to shut down its IT systems.<br \/>\nFor technical guys, here are the Conti ransomware indicators according to the FBI\u2019s announcement: \u201cConti actors use remote access tools, which most often beacon to domestic and international virtual private server (VPS) infrastructure over ports 80, 443, 8080, and 8443. Additionally, actors may use port 53 for persistence. Large HTTPS transfers go to cloud-based data storage providers MegaNZ and pCloud servers. Other indicators of Conti activity include the appearance of new accounts and tools\u2014particularly Sysinternals\u2014which were not installed by the organization, as well as disabled endpoint detection and constant HTTP and domain name system (DNS) beacons, and disabled endpoint detection.\u201d<br \/>\nIf you are an IT admin or security expert at a healthcare organization, note these indicators so you can protect your data from this ransomware. The FBI has asked all organizations attacked by Conti ransomware to share their information.<br \/>\nThe post Conti Ransomware Attacked 16 Healthcare Organizations, FBI Says appeared first on Android Headlines.&#013;<br \/>\n<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/plus.maciejpiasecki.info\/wp-content\/uploads\/2021\/05\/Privacy-Cyber-Security-AH-Nov-AH-2019-600x338-1.jpg\" width=\"600\" height=\"338\">&#013;<br \/>\nSource: ndroidheadlines.com&#013;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>According to the Federal Bureau of Investigation (FBI), Conti ransomware has recently targeted at least 16 healthcare organizations in the [&hellip;]<\/p>\n","protected":false},"author":26,"featured_media":7606,"comment_status":"false","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-7605","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bez-kategorii"],"_links":{"self":[{"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/posts\/7605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/users\/26"}],"replies":[{"embeddable":true,"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/comments?post=7605"}],"version-history":[{"count":1,"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/posts\/7605\/revisions"}],"predecessor-version":[{"id":7607,"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/posts\/7605\/revisions\/7607"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/media\/7606"}],"wp:attachment":[{"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/media?parent=7605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/categories?post=7605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/plus.maciejpiasecki.info\/index.php\/wp-json\/wp\/v2\/tags?post=7605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}