The American Hospital Association (AHA) is warning U.S. hospitals about possible cyber attacks from Russia on U.S. healthcare IT systems due to rising tensions over the war in Ukraine.

With the severe economic sanctions now starting to take a toll on the Russian economy, the AHA said there is concern that Russia may retaliate against the U.S. and allied nations with disruptive cyberattacks.

"We want hospitals, their C-suite executives and chief information officers to take this very seriously. There is a war going on and the adversary is very proficient in cyberattacks." stressed John Riggi, the AHA'snational advisor for cybersecurity and risk, and a former senior executive in the FBI’s cyber division.

"Cyber threats are not just an IT issue, it is an enterprise-wide problem," Riggi explained. This includes bringing down mission-critical systems for extended periods of time.

If previous experience with Russian malware is any gauge of what to expect, Riggi said healthcare systems need to be prepared to operate 4 to 6 weeks without the ability to use their computers or archive data. This includes electronic medical records (EMR), PACS, HIS,  drug dispensing systems like Pyxis, inventory management, dictation, digital pathology, billing, scheduling, pharmacy, clinical reporting systems and all other IT networked within the healthcare enterprise.

Riggi is in close coordination with the FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) regarding related threats which may pose a risk to U.S. healthcare. When he spoke with Healthcare Exec, he had just gotten off the phone from recording a webinar with the FBI aimed at helping hospitals better understand the Russian cyber threat.

The AHA said it is closely monitoring the potential for increased cybersecurity risks to the U.S. health system. The Russian military has previously used cyber attacks against Ukraine to disrupt the electrical grid, communications capabilities and financial institutions. For example, it was reported last week that cyber denial-of-service attacks, attributed to the Russian military, were launched against Ukraine’s Ministry of Defense, as well as its financial institutions.

In light of previous attacks and potential threats, CISA this past week issued a rare cyber “Shields Up” warning to the U.S. private sector, including healthcare organizations. This was based on the increased cyberthreat posed by the Russian government. The warning stated "every organization — large and small — must be prepared to respond to disruptive cyber activity."

Russia already has initiated cyber attacks against Ukraine

"The primary concern is not a direct attack, but healthcare becoming collateral damage from a cyber attack in Ukraine," Riggi warned. "They are not going to send bombers over here to bomb Wall Street, but they might send malware." 

CISA and the FBI issued a warning Feb. 26 that the Russians had released destructive malware to target organizations in Ukraine, including the WhisperGate and HermeticWiper malware.

On Feb. 23, CISA, the U.K. National Cyber Security Centre (NCSC-UK), National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) released a joint cybersecurity advisory identifying that the actor known as Sandworm or Voodoo Bear is using a new malware, referred to as Cyclops Blink. The NCSC, CISA, and FBI have previously attributed the Sandworm actor to the Russian General Staff Main Intelligence Directorate’s Russian (GRU’s) Main Centre for Special Technologies (GTsST). CISA said Cyclops Blink appears to be a replacement framework for the VPN Filter malware exposed in 2018. That older malware exploited network devices, primarily small office/home office routers and network attached storage devices.

More attacks of this type are expected, CISA warned.

Russian Conti ransomware gang poses threat to healthcare organizations

Conti is a notorious Russia-linked ransomware group of hackers that have extorted millions from victims across the globe, including the U.S. and Europe. The Wall Street Journal reported Conti ransomware was used in attacks in 2021 on Ireland’s public-health infrastructure. The gang was also responsible for 16 targeted attacks on U.S. emergency responders, including hospitals and 911 call centers, the Federal Bureau of Investigation (FBI) said.

Riggi said the attacks from last year make Conti a credible threat to healthcare IT systems. He also said the hacking gang last Friday made an online statement of support for Moscow and threatened forcefully respond in kind to any cyberattacks against Russia.

American Hospital Association is coordinating cybersecurity efforts with the government and healthcare organizations

As part of AHA’s efforts, John Riggi, the association’s national advisor for cybersecurity and risk, and a former senior executive in the FBI’s cyber division, remains in close coordination with the FBI, CISA and the Department of Health and Human Services (HHS) regarding related threats which may pose a risk to U.S. healthcare.

The AHA outlined the following context of the current cyberthreat environment:

   • Hospitals and health systems may be targeted directly by Russian-sponsored cyber actors.
   • Hospitals and health systems may become incidental victims of, or collateral damage to, Russian-deployed malware or destructive ransomware that inadvertently penetrates U.S. healthcare entities.
   • A cyberattack could disrupt hospitals’ mission-critical service providers.

"AHA’s concerns are heightened by the Russian military’s previous behavior of utilizing cyber weapons in support of military actions against Ukraine," the AHA stated in a cyber security advisory posted Feb. 23. 

Previous cyber attacks on Ukraine resulted in $1 billion in damage to U.S. healthcare infrastructure

The AHA said previous Russian cyber attacks inflicted disruptive collateral damage to the U.S. healthcare system. The U.S. government in 2020 indicted six Russian military intelligence officers for the development and deployment of the destructive NotPetya malware in 2017. The malware was initially launched against Ukraine, but subsequently spread globally, disrupting operations at the U.S. pharmaceutical company Merck, the key U.S. healthcare communications company Nuance, and at some U.S. hospitals. "There were delays in treating patients because doctors' notes could not be retrieved," Riggi said.

The 2017 attack caused more than $1 billion in damages in the U.S., including  Heritage Valley Health System. The U.S. Department of Justice said Heritage Valley lost access to its mission-critical computer systems. These including computer systems relating to cardiology, nuclear medicine, radiology and surgery, which were down for about a week. The health system also lost access to its administrative computer systems for almost a month. The Justice Department said this was a serious threat to public health and safety.

AHA guidance related to government warnings of Russian cyberattacks

The AHA said it has served as a platform to amplify and provide guidance related to recent government warnings and advisories:

   • The AHA on Jan. 28, 2022, received an FBI request for information regarding Russia’s recent buildup of armed forces along its shared border with the Ukraine.

   • CISA Jan. 16 issued an advisory on destructive malware identified on networks in the Ukraine and to take action to strengthen their networks against potential cyberthreats.

   • The AHA and the Health-Information Sharing and Analysis Center (H-ISAC) Jan. 14 issued a joint advisory strongly recommending organizations identify, and consider blocking, any direct or third-party business associate connections and email contacts based in the Ukraine and that region of the world.

   • The FBI and National Security Agency on Jan. 11 released recommendations to help healthcare and other critical infrastructure organizations prevent, detect and respond to common Russian state-sponsored cyberthreats.

What hospitals can do to prepare against Russian cyber attacks

The AHA urging hospitals and health systems to take the following cybersecurity steps immediately to help mitigate cybersecurity attack risks:

   • Share the AHA cyber security advisory with your organization’s IT and cyber infrastructure teams.
 
   • Hospitals and health systems should review the above-identified alerts and bulletins for guidance on risk mitigation procedures, including increased network monitoring for unusual network traffic or activity, especially around active directory. Additionally, it is important to heighten staffs’ awareness of increased risk of receiving malware-laden phishing emails.
 
   • Geo-fencing for all inbound and outbound traffic originating from, and related to, Ukraine and its surrounding region may help mitigate direct cyber risks presented by this threat; however, it will have limited impact in reducing indirect risk, in which malware transits through other nations, proxies and third parties.
 
   • AHA also recommends that organizations identify all internal and third-party mission-critical clinical and operational services and technology; in doing so they should put into place four-to-six week business continuity plans and well-practiced downtime procedures in the event those services or technologies are disrupted by a cyberattack.
 
   • It is essential at this time to check the redundancy, resiliency and security of your organization’s network and data backups, and ensure that multiple copies exist: off-line, network segmented, on premises and in the cloud, with at least one immutable copy.
 
   • It is also critical that a cross-function, leadership-level cyber incident response plan be fully documented, updated and practiced. This should include emergency communications plans and systems.

Information on Russian cyberattacks in Ukraine in January and February 2022

While there are no specific or credible cyber threats to the U.S. homeland at this time, Russia’s unprovoked attack on Ukraine, which has involved cyber-attacks on Ukrainian government and critical infrastructure organizations, may impact organizations both within and beyond the region, particularly in the wake of sanctions imposed by the United States and its Allies. 

The U.K. has determined Russia was also involved in distributed denial of service (DDoS) attacks in Ukraine in the days prior to the invasion. The U.K. government National Cyber Security Centre said the Russian Main Intelligence Directorate (GRU) was involved in the distributed denial of service attacks against the financial sector in Ukraine Feb 15-16.

CISA issued an initial warning from Microsoft in late January 2022 that Russian hackers were using destructive malware targeting Ukrainian organizations. This software is now being used in force against Ukrainian organizations. It appears as a ransomware app that shows a ransom note for data, but loads a master boot record (MBR) wiper software that deletes all files on the network.

Microsoft was alerted to these attacks in progress and worked to contain the damage and stop the spread of the malware.

Read more detailed information on these attacks.