The IT Nerd

Recently, Australian mining company, Northern Minerals, disclosed a breach after BianLian leaked data. Exfiltrated data includes corporate, operational, shareholder and financial information, along with detailed related to current and former personnel. The company noted that the incident did not affect mining or business operations. 

Darren Williams, CEO and Founder, BlackFog:

“The attack on Northern Minerals is an example of how ransomware gangs will proceed once their demands are not met. While this is an unfortunate reality for the shareholders and the organization itself, it reflects a common trend among ransomware gangs that are focused specifically on data exfiltration rather than encryption.  Today’s gangs are about extortion and the many ways data can be leveraged for financial gain, so the focus must revolve around data security and preventing data exfiltration to protect organizations from these ongoing threats.”

The best way to make the activities of these gangs less profitable is to make sure that they can’t get into your environment. Because you can’t be extorted if they can’t get in.

Following up on this story about London hospitals getting pwned by a ransomware attack, I have more details on this. On the surface, this appears to be yet another third party attack.

The attack targeted Synnovis, a third-party provider responsible for pathology services such as blood tests, swabs, and bowel tests for the affected hospitals. As a result, crucial services like blood transfusions and test results have been disrupted.

In response to the attack, both Guy’s and St Thomas’ and King’s College Hospital have declared a “critical incident.” The Independent reports that general practitioners have been instructed to cancel all non-emergency pathology appointments, and hospital staff have been directed to request emergency blood samples only for patients requiring transfusions. 

A spokesperson for NHS England’s London region stated, “This is having a significant impact on the delivery of services at Guy’s and St Thomas’, King’s College Hospital NHS Foundation Trusts and primary care services in southeast London, and we apologize for the inconvenience this is causing to patients and their families.” Despite the disruption, emergency care remains available, and patients are advised to continue accessing services as usual, including dialing 999 in emergencies.

According the The Record, the NHS suffered 138 ransomware attacks in just 2022 and 2023.

Experts with Cyware and Horizon3.ai offer perspective:

Emily Phelps, Director, Cyware had this to say:

   “These ransomware attacks targeting healthcare and critical infrastructure reinforce the urgent need for a collective defense security approach. This incident, which has  disrupted critical healthcare services, highlights the vulnerabilities inherent in siloed systems that slow down response times. 

   “A unified defense strategy and modernized security operations not only mitigate risks but also ensure a quicker and more efficient response, safeguarding essential services and protecting patient care.

Stephen Gates, Principal Security SME, Horizon3.ai follows with this:

   “What all organizations must come to terms with is that their exploitable attack surface is no longer just their own – it now encompasses their suppliers’ attack surfaces as well. A successful attack against a smaller supplier, who is part of a larger supply chain, can in fact cause disruption to their upstream buyer community. Therefore, it is critical for organizations to not only continuously assess their own security postures, but the security postures of their suppliers as well.

   “The challenge here is how do you continuously assess yourself – and your suppliers? Traditionally, organizations relied on two assessment approaches: Checkbox assessment exercises or manual penetration tests. The first does not always guarantee better security and the latter is nearly impossible to perform in a continuous fashion.

   “However, there are autonomous assessment solutions and approaches readily available that can continuously (and preemptively) discover exploitable vulnerabilities and other weaknesses so organizations can resolve them before attackers discover them. It’s time for both public and private sector organizations to adopt these solutions and approaches before this sort of event becomes the norm

Third party attacks are the new problem of the moment. Which means that you need to ensure that you take into account the security practices of your suppliers and partners if you want to stay secure. Otherwise you get situations like this.

With the new RansomHub ransom gang becoming very active in the last couple of months, security researchers have come to believe that the ransomware-as-a-service evolved from the Knight ransomware project. Analysts have found multiple similarities between the two – the list is included in a Bleeping Computer article.

Darren Williams, CEO and Founder, BlackFog:

“The spawning of new ransomware gangs from older ones is not unusual, and we have seen this regularly over the last several years as they continue to share and leverage multiple variants at the same time. The simple fact is the risks associated with cybercrime are so low that its significantly less dangerous than any other form of crime, especially when you consider that most originate in China and Russia where law enforcement is not cooperative. The focus of organizations needs to be on both defensive and preventative strategies to protect all digital assets from the inside. Focusing on data exfiltration to prevent a data breach and loss of data is a good first step that many organizations fail to recognize in their security posture.”

The risk that ransomware gangs face need to be increased. Otherwise there is zero deterrent in terms of them launching attacks on companies. Hopefully countries around the world get the message so that these gangs disappear out of fear of the consequences of their actions.