Security

US CERT Warns of North Korean Cyberthreats for Healthcare Organizations

The healthcare industry, among others, could be at risk for DDoS botnet attacks.

The U.S. Computer Emergency Readiness Team has issued an alert that warns of possible malicious cyberactivity from North Korea.

“Working with U.S. Government partners, DHS and FBI identified Internet Protocol (IP) addresses associated with a malware variant, known as DeltaCharlie, used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure,” the alert notes. The government refers to this malicious cyberactivity as HIDDEN COBRA.

While the alert specifically mentions the media, aerospace, financial, and critical infrastructure sectors, the healthcare industry could be impacted, and organizations should be particularly wary after the recent WannaCray attacks that crippled many healthcare organizations globally.

“Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Wild Positron/Duuzer, and Hangman,” U.S. Cert says in the alert.

It also points out that HIDDEN COBRA actors commonly target systems running on older and unsupported version of Microsoft operating systems.

“The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation. These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users’ environments,” the alert says.

In particular, it points to the following vulnerabilities: