Healthcare Industry Rocked by Major Hack

ALPHV, auto updates, Backup Strategies, BlackCat, Hackers, identify phishing, Ophtek, Ransomware, , , , , , ,
23
Apr 2024

Healthcare data is some of the most sensitive data in existence, but a major hack has just affected up to 15 billion records.

Change Healthcare, who provide revenue and payment services for healthcare providers and patients, has announced that its systems have been compromised by threat actors. With Change Healthcare processing around 15 billion transactions a year, this represents a major attack. And the impact has already been felt. Healthcare providers have been struggling to charge for their services, while patients have been struggling to get their prescriptions issued. It’s a nightmare scenario for all involved and underlines the effect malware can have.

How Did Change Healthcare Get Hacked?

The precise details of how Change Healthcare was hacked has not, as yet, been revealed. However, we do know it was carried out by a ransomware group which goes by the names of ALPHV or BlackCat. Naturally, their trademark attack style involves ransomware, and it’s most likely that this was utilized in the Change Healthcare attack. With ransomware typically encrypting data, this is highly damaging for any service handling healthcare data. By encrypting patient records, the hackers would be severing a crucial flow of information.

The attack came on the 21st February 2024, and Change Healthcare took down their systems on the same day. A week later, BlackCat announced they had been behind the attack. Details of a $22 million payment to the ransomware groups have also been revealed, although Change Healthcare are yet to confirm this was made by themselves. Prescription claim submissions and payment systems have recently been reinstated by Change Healthcare, but full access to their systems is unlikely to be restored until mid-March.

Who is BlackCat?

BlackCat has been active online since 2021 and, since then, has launched a series of audacious attacks. The group was linked to the Colonial Pipeline ransomware attack in 2021, and it also took responsibility for the MGM Casino attack in 2023. Headlines such as these didn’t go unnoticed, and in December 2023, the US Department of Justice set about disrupting BlackCat’s activities. Clearly, though, the resulting Change Healthcare attack has demonstrated how BlackCat was unharmed by this resistance.

Staying Safe from Ransomware

The threat of ransomware is well known, but the Change Healthcare attack is a big deal and acts as an important reminder to stay vigilant. With this in mind, we’re going to show you the best ways to stay safe from ransomware:

  • Regular software updates: ransomware often takes control of IT infrastructures due to software vulnerabilities. Accordingly, you need to make sure automatic updates are activated on your operating system. This ensures your software is updated as soon as an update is available, preventing you from running a network with open doors for threat actors.
  • Employee training: your employees are one of your most powerful forms of defense against ransomware threats. Therefore, regular training on cybersecurity threats such as identifying phishing emails, malicious websites, and understanding how to report cybersecurity incidents is vital. With this in place, you can rest assured your network is as secure as possible.
  • Regular, isolated backups: you need to regularly back up critical data and ensure that backups are stored in a secure, isolated location. Automated backup solutions can help ensure consistency and reliability in the event of your data being encrypted by ransomware.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Chinese PC Maker Ships PCs Customized for Malware

Acemagic, Bladabindi, China, info stealers, malware, Ophtek, PC vulnerabilities, Redline, Windows source code, , , , , , , ,
16
Apr 2024

In a highly embarrassing incident for Acemagic, a Chinese PC manufacturer, a number of its products have been shipped with numerous vulnerabilities.

When setting up a brand-new PC out of the box, you would expect it to be highly secure and as protected against current threats as it could be. However, this isn’t always the case. PCs are complex pieces of machinery, packed full of processes, apps and coding to provide the full PC experience. And all of this leaves room for mistakes. Acemagic has learned this the hard way, as have their customers, who have now found their brand-new PCs are vulnerable to countless malware threats.

It’s a nightmare scenario for all involved, so we’re going to look at what’s happened.

The Dangers of Tinkering with Windows Source Code

In a bid to improve the performance of their PCs, Acemagic’s software developers decided to adjust Microsoft’s source code for Windows. This involved altering network settings, but inadvertently resulted in the process of digital signature verification being skipped. Digital signatures are used to verify the authenticity of data passing through PCs, so, without these in place, applications are at risk of being compromised with malware. Acemagic’s aim was to reduce boot times for its customers, but it resulted in the PCs becoming infected with malware.

From bootup, security researchers have been able to discover malware such as Bladabindi and Redline on Acemagic PCs. Both these strains of malware are designated as info stealers, so they have the potential to steal login credentials, financial data, and also download further malware. Additionally, Redline is capable of stealing cryptocurrency.

Acemagic has announced that the software adjustments were stopped on November 18th 2023, but this still leaves a large number of compromised PCs in use by unsuspecting users. Going forwards, Acemagic has pledged to put more focus on digital certificates, a move they claim will be able to stop unauthorized modifications in the future. But the damage to Acemagic’s reputation has been done, and it’s not been helped by the fact that Acemagic has been unable to pinpoint exactly when the malware was downloaded onto their machines.

Staying Safe with New PCs

A new PC should be as safe as you can get, but the Acemagic fiasco has demonstrated how they can be just as dangerous as a PC which is several years old. Therefore, it’s crucial you take precautions when setting up a new PC:

  • Set it up offline: to protect your existing network, it’s a good idea to fully set up your PC before connecting it to your network. Not only does this ensure the PC is correctly configured to join your network, but it also allows you to secure the device and limit the spread of any pre-installed malware.
  • Scan for malware: one of the first things you should do with a new PC is scan it for malware. As we’ve seen with Acemagic, even brand-new PCs can be compromised with malware, so it makes sense to eliminate this threat before it can become active on your network. Running a quick scan with apps such as AVG or McAfee will identify any threats and quickly remove them.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The Importance of Quick IT Support Response Times

IT contact numbers, IT infrastructure, IT Support, minimize IT issues, Ophtek, , , ,
09
Apr 2024

Every second counts when it comes to IT support, as unresolved issues can quickly become costly. And speed is something which Ophtek prides itself on.

The digital business landscape of the 21st century is wide-reaching and informs countless business decisions throughout the day. From emails through to data storage and on to cybersecurity defenses, your IT infrastructure is crucial. Therefore, when there’s an issue with your IT systems, you need these to be resolved quickly, otherwise the financial impact – especially with cybercrime – can be significant.

The Impact of Downtime

Anything which creates an issue for your operational processes is going to have a financial impact. Say, for example, your data storage solutions fail, this is going to restrict the amount of data you have available. This could easily impact your operations by disrupting the way in which you retrieve customer data. Deliveries, which require customer details such as delivery addresses, could be put on hold. This scenario would instantly compromise your ability to invoice, with customers unlikely to pay for goods not received on time.

Likewise, if your email server were to become compromised by threat actors, you risk not only exposing your customers’ data, but also losing a major communication channel. This is a double-edged threat and, again, represents a major financial risk. Aside from your customers taking legal action against you for data violations, there’s the fact you could miss key communications from your customers and suppliers.

Every minute of downtime has the potential to push your business backwards, and it’s vital you can counter this effectively.

Minimize The Impact with a Speedy Response

It’s clear that IT is important for organizations to conduct their day-to-day operations, and any disruption to this will have major ramifications. The best way to minimize this is by ensuring you can launch a quick response. This will reduce your downtime and allow your organization to get its business operations back on track. Furthermore, it will minimize any financial risk e.g. allow you to resume order processing and any billing processes. And in today’s competitive business landscape, this is essential.

The best way to plan and execute quick IT support response claims is by partnering yourself with an established IT support provider, such as Ophtek. With a long track record of providing speedy and professional support, we can ensure that any IT downtime is kept to a minimum. Nonetheless, you can still put measures in place to help minimize your IT issues and facilitate our response:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Understanding Data Governance for Business IT

compliance, data governance, Employee Training, internal audits, limit data access, Ophtek, privacy, protecting data, sensitive date, , , , , , , ,
02
Apr 2024

Digital data is perhaps the most valuable asset your organization handles, but just how secure, safe, and compliant is it?

Data governance is a crucial element of business IT and one which businesses must comply with. It gives both accountability and responsibility to the data owners, ensuring sensitive data and privacy is correctly handled. This governance can either be internal – such as data policies specific to an organization – or external, such as government or regulatory bodies. The objective of data governance is to secure data and make sure it’s not misused.

Naturally, with cyber crime showing no signs of slowing up in 2024, it’s vital you have a firm understanding of data governance for business IT.

What is Data Governance?

Data governance is a complex set of procedures and policies which can be difficult to get to grips with. However, the basics are simple to understand. A simple explanation for data governance is that it focuses on the strategic management of all the data you hold. By monitoring your data and the way in which it is used, you build defenses around that data. This allows you to minimize the risks associated with data breaches, build trust among your stakeholders, and assist with informed decision making around your data.

The Importance of Compliance

Many industries are governed by strict regulatory requirements e.g. the healthcare industry needs to adhere to the strict framework put in place by HIPAA regulations. Regardless of the industry or regulatory framework, the aim of compliance remains the same. By demonstrating adherence to compliance, you’re underlining the fact that any sensitive data you hold is protected and handled correctly. If your organization fails to hit the benchmarks laid out by external bodies, then you run the risk of some eyewatering financial penalties.

Improving Your Data Security

The best way to maximize your compliance and governance is to enhance your data security. You can achieve this in the following ways:

  • Employee training: one of the most common causes of data breaches is your employees. These are the individuals who are most at risk of falling victim to social engineering, phishing emails, and malvertising threats. Accordingly, you need to implement a robust training schedule for new starters and, for all staff, follow up with refresher courses.

Final Thoughts

With the rise of big data in business, it’s clear that good data governance practices should be a priority for any business. This will allow you to build a strong foundation of data governance to protect both your organization and your customers.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

VexTrio Uses 70,000 Hijacked Websites to Spread Malware

ClearFake, Hijacked websites, Malicious traffic distribution system, malvertising, malware, Ophtek, Phishing, SocGholish, TDS, VixTrio, , , , , , , , ,
26
Mar 2024

Threat actors have compromised 70,000 previously legitimate websites and created a powerful network capable of distributing malware.

Named VexTrio, this network of compromised websites appears to have started in 2017, but it’s only more recently that details around its activity have emerged. As well as distributing malware, the VexTrio network also utilizes phishing pages, and allows the VexTrio hackers to harvest login credentials. The campaign is a significant one, and one which is powerful enough to cause harm to anyone who gets caught up in its operations. Therefore, it’s time to take a look at the VexTrio campaign to see what we can learn.

Understanding the VexTrio Network

The VexTrio campaign relies on a malicious traffic distribution system (TDS) to lead unsuspecting internet users to compromised websites. A TDS is, in simple terms, a web application used to analyze and filter incoming traffic and, following the analysis, redirect it to a specific page. Typically, the activities of a TDS are facilitated by malvertising activities or malicious websites. VexTrio favors using malicious websites.

Working with a number of affiliates, many of whom offer access to hijacked websites, VexTrio has managed to amass a sizeable network over the last seven years. And VexTrio are very much the middle-man in the operation. For a fee, VexTrio will feed incoming traffic through their TDS and forward innocent victims towards the websites they’re mostly likely to be interested in. It’s very similar to legitimate advertising networks, but with a vicious sting in its tale.

The malicious websites which comprise the VexTrio network contain a wide range of threats. For example, one of the affiliates, known as ClearFake, tricks users into downloading what is claimed to be a browser update, but is little more than malware. SocGholish, another well-known malware threat, is part of the VexTrio network and uses it to push unauthorized access to corporate websites.

Don’t Fall Victim to VexTrio

The threat of VexTrio is a substantial one, and organizations need to be aware of the damage it can cause. Luckily, you can protect yourself and your IT systems by implementing the following best practices:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 2 3 … 116