Fast-moving Ryuk campaign targets healthcare organisations

A newly designated cyber criminal group is foregoing the widespread double extortion tactic in favour of a more retro approach to ransomware, as it mercilessly targets healthcare organisations using Ryuk.

Dubbed FIN12 by the Mandiant threat researchers who have been tracking it for over a year now, the gang has been responsible for approximately 20% of all ransomware intrusions Mandiant has responded to in the past 12 months.

The majority of its attacks have culminated in the deployment of Ryuk against its targets – although there is also evidence it is a minor affiliate of Conti. FIN12 – the FIN refers to “financially motivated” in Mandiant’s lexicon – is notable in particular because its average time-to-ransom is approximately two and a half days, about twice as fast as other actors.

Mandiant said this highlighted a growing concern that both larger teams and increased efficiency mean that such gangs are improving their overall volume of victims.

“FIN12 is one of the most aggressive ransomware threat actors tracked by Mandiant,” said Mandiant’s director of financial crime analysis, Kimberly Goody. “Unlike other actors who are branching out into other forms of extortion, this group remains focused purely on ransomware, moving faster than its peers and hitting big targets.

“They are behind several attacks on the healthcare system and they focus heavily on high-revenue victims,” she said.

“Nothing is sacred with these actors – they will go after hospitals and healthcare facilities, utilities, and critical infrastructure. This illustrates that they choose not to abide by the norms.”

Jamie Collier, a cyber threat intelligence consultant at Mandiant, said that while the Russia-based gang had largely confined its targeting to North American organisations, it now posed a rising threat on this side of the Atlantic Ocean.

“Mandiant has observed a significant uptick in FIN12 operations targeting European organisations since the beginning of 2021, including those based in France, Ireland, Spain and the UK,” he said.

“FIN12 is known for targeting large organisations with significant revenues. Europe provides ample opportunities for cyber criminals to exploit, given the sheer number of large economies as well as various large multinationals that have their headquarters located in the continent.

“FIN12’s increased targeting outside of North America is emblematic of a wider trend, with the cyber crime threat growing increasingly severe in Europe,” said Collier. “Despite the large number of developed economies, the cyber security maturity of European organisations is relatively mixed. This presents clear opportunities for cyber criminals to exploit entities that are still developing their cyber security posture.”

Mandiant said the targeting of European healthcare organisations was of particular concern because, since many more European countries run national healthcare systems, such as the NHS, a cyber attack would have a far wider impact on people’s lives than an attack on a privatised American healthcare business.

Its research team added that the increased focus on fighting back against ransomware attacks at the highest levels of the US government, with threats of real-world repercussions including crackdowns on money laundering through crypto exchanges, was likely also making it less desirable for gangs such as FIN12 to operate in the US.