April 18, 2022

Conti — one of the most ruthless and successful Russian ransomware groups — publicly declared during the height of the COVID-19 pandemic that it would refrain from targeting healthcare providers. But new information confirms this pledge was always a lie, and that Conti has launched more than 200 attacks against hospitals and other healthcare facilities since first surfacing in 2018 under its earlier name, “Ryuk.”

On April 13, Microsoft said it executed a legal sneak attack against Zloader, a remote access trojan and malware platform that multiple ransomware groups have used to deploy their malware inside victim networks. More specifically, Microsoft obtained a court order that allowed it to seize 65 domain names that were used to maintain the Zloader botnet.

Microsoft’s civil lawsuit against Zloader names seven “John Does,” essentially seeking information to identify cybercriminals who used Zloader to conduct ransomware attacks. As the company’s complaint notes, some of these John Does were associated with lesser ransomware collectives such as Egregor and Netfilim.

But according to Microsoft and an advisory from the U.S. Cybersecurity & Infrastructure Security Agency (CISA), Zloader had a special relationship with Ryuk/Conti, acting as a preferred distribution platform for deploying Ryuk/Conti ransomware.

Several parties backed Microsoft in its legal efforts against Zloader by filing supporting declarations, including Errol Weiss, a former penetration tester for the U.S. National Security Agency (NSA). Weiss now serves as the chief security officer of the Health Information Sharing & Analysis Center (H-ISAC), an industry group that shares information about cyberattacks against healthcare providers.

Weiss said ransomware attacks from Ryuk/Conti have impacted hundreds of healthcare facilities across the United States, including facilities located in 192 cities and 41 states and the District of Columbia.

“The attacks resulted in the temporary or permanent loss of IT systems that support many of the provider delivery functions in modern hospitals resulting in cancelled surgeries and delayed medical care,” Weiss said in a declaration (PDF) with the U.S. District Court for the Northern District of Georgia.

“Hospitals reported revenue losses due to Ryuk infections of nearly $100 million from data I obtained through interviews with hospital staff, public statements, and media articles,” Weiss wrote. “The Ryuk attacks also caused an estimated $500 million in costs to respond to the attacks – costs that include ransomware payments, digital forensic services, security improvements and upgrading impacted systems plus other expenses.”

The figures cited by Weiss appear highly conservative. A single attack by Ryuk/Conti in May 2021 against Ireland’s Health Service Executive, which operates the country’s public health system, resulted in massive disruptions to healthcare in Ireland. In June 2021, the HSE’s director general said the recovery costs for that attack were likely to exceed USD $600 million.

Conti ravaged the healthcare sector throughout 2020, and leaked internal chats from the Conti ransomware group show the gang had access to more than 400 healthcare facilities in the U.S. alone by October 2020.

On Oct. 28, 2020, KrebsOnSecurity broke the news that FBI and DHS officials had seen reliable intelligence indicating the group planned to ransom many of these care facilities simultaneously. Hours after that October 2020 piece ran, I heard from a respected H-ISAC security professional who questioned whether it was worth getting the public so riled up. The story had been updated multiple times throughout the day, and there were at least five healthcare organizations hit with ransomware within the span of 24 hours.

“I guess it would help if I understood what the baseline is, like how many healthcare organizations get hit with ransomware on average in one week?” I asked the source.

“It’s more like one a day,” the source confided.

A report in February 2022 from Sophos found Conti orchestrated a cyberattack against a Canadian healthcare provider in late 2021. Security software firm Emsisoft found that at least 68 healthcare providers suffered ransomware attacks last year.

While Conti is just one of many ransomware groups threatening the healthcare industry, it seems likely that ransomware attacks on the healthcare sector are underreported. Perhaps this is because a large percentage of victims are paying a ransom demand to keep their data (and news of their breach) confidential. A survey published in February by email security provider Proofpoint found almost 60 percent of victims hit by ransomware paid their extortionists.

Or perhaps it’s because many crime groups have shifted focus away from deploying ransomware and toward stealing data and demanding payment not to publish the information. Conti shames victims who refuse to pay a ransom by posting their internal data on their darkweb blog.

Since the beginning of 2022, Conti has claimed responsibility for hacking a cancer testing lab, a medical prescription service online, a biomedical testing facility, a pharmaceutical company, and a spinal surgery center.

The Healthcare Information and Management Systems Society recently released its 2021 HIMSS Healthcare Cybersecurity Survey (PDF), which interviewed 167 healthcare cybersecurity professionals and found 67 percent had experienced a “significant security incident” in the past year.

The survey also found that just six percent or less of respondent’s information technology budgets were devoted to cybersecurity, although roughly 60 percent of respondents said their cybersecurity budgets would increase in 2022. Last year, just 79 percent of respondents said they’d fully implemented antivirus or other anti-malware systems; only 43 percent reported they’d fully implemented intrusion detection and prevention technologies.

The FBI says Conti typically gains access to victim networks through weaponized malicious email links, attachments, or stolen Remote Desktop Protocol (RDP) credentials, and that it weaponizes Microsoft Office documents with embedded Powershell scripts — initially staging Cobalt Strike via the Office documents and then dropping Emotet onto the network — giving them the ability to deploy ransomware. The FBI said Conti has been observed inside victim networks between four days and three weeks on average before deploying Conti ransomware.


18 thoughts on “Conti’s Ransomware Toll on the Healthcare Industry

  1. The Sunshine State

    The declaration (PDF) from the U.S. District Court for the Northern District of Georgia., doesn’t work DOH!

  2. ZYami

    Sad For The declaration (PDF) from the U.S. District Court for the Northern District of Georgia

  3. Wannabe techguy

    Would this even be possible if everything wasn’t internet facing?

  4. Techronik

    My understanding is that after Conti came, Ryuk took a short break (maintenance), but never disappeared, and was never replaced. They are different tools. Conti is for the longer haul and data theft/extortion. Ryuk is for faster results and encryption only (no data theft) with a very short turnaround time. Has anyone ever seen a “Ryuk leak?” Does anyone know anything contrary to this?

    1. Texas Pete

      Not correct. Both are groups/cartels and not tools. Conti showed up after Ryuk disappeared and uses similar techniques and toolsets, so some into infosec business consider them the same people or an offshoot. Ryuk definitely had a leak site on the dark web, but the game then was to display it demonstrate proof of data and encrypt or lock the data on premise. The bad guys just evolved this to data ransoms and double extortion.

      1. Techronik

        I guess “tool” was a poor choice of words. They are definitely groups – RaaS at least for Conti, but there is coordinated management somewhere near the top. I’ve never seen any Ryuk leak sites, but that doesn’t mean it has never been there. In recent history (and yes, Ryuk is still active), they encrypt and don’t worry about stealing data, making their attacks much faster. As a reference – https://www.zdnet.com/article/ransomware-this-gang-is-getting-a-lot-quicker-at-encrypting-networks/

  5. Brian Fiori (AKA The Dean)

    Just an FYI. The PDF from Georgia continues to be blocked by Malwarebytes Browser Guard “due to a trojan”. It seems at least one other commenter had issues downloading it, as well.

  6. TheCyberPost

    Hey Brian just a quick correction in the first paragraph you have Netfilim the group was * Nefilim Ransomware.

  7. Observer

    “estimated $500 million in costs to respond to the attacks” … “security improvements and upgrading impacted systems”
    Aren’t some of these expenses standard computer security practice? Is this an example of “pay me now or pay me later”?

  8. c1ue

    As Observer notes above: $100m in revenue losses vs $500m in response costs seems like a terrible ratio.
    It conveys the impression that the attacks are doing little damage vs the response: an infosec cytokine storm, so to speak.

  9. Alistair Woeke

    Krebs achieves the perfect unison of the “narrative du jour” in this article; melding C19 hysteria with anti-Russian hysteria. CNN would be proud. Cheque from Langley is in the mail

    1. Who Woke Boris?

      Krebs achieved making you cry about it, little baby wiper Q-Anoob.

Comments are closed.