Incident
incident:threatlocker_hospital_ransomware_incident
Incident in which a threat actor used purchased domain-administrator credentials to enter a hospital through VPN access, was blocked on protected systems, pivoted to a connected hospital environment, and demanded ransom.
Incident in which a threat actor used purchased domain-administrator credentials to enter a hospital through VPN access, was blocked on protected systems, pivoted to a connected hospital environment, and demanded ransom.
“The threat actor had bought credentials off the dark web”
“they began to pivot to other locations in the environment”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | ThreatLocker | Explicit | 167 |
| outgoing | INVOLVES | EDR | Explicit | 167 |
| outgoing | INVOLVES | AnyDesk | Explicit | 167 |
| outgoing | INVOLVES | rclone | Explicit | 167 |
| outgoing | INITIAL_ACCESS_VIA | VPN | Explicit | 167 |
| outgoing | INVOLVES | Windows | Explicit | 167 |
| outgoing | INVOLVES | Ransomware | Explicit | 167 |
ThreatLocker hospital ransomware incident INVOLVES ThreatLocker
Ark’s team installed ThreatLocker on the hospital’s servers and computers, and ThreatLocker later blocked tools the threat actor attempted to use.
Explicit Confidence 98% · Jack Rhysider EP 167 Details
“we brought in ThreatLocker, installed it on all the servers and computers”
“ThreatLocker had blocked the solutions that the threat actor had planned on leveraging”
ThreatLocker hospital ransomware incident INVOLVES EDR
The hospital incident involved an EDR/MDR solution that detected activity in the environment.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“we got a call from the EDR/MDR solution that we were using that there was someone in the environment”
ThreatLocker hospital ransomware incident INVOLVES AnyDesk
ThreatLocker blocked AnyDesk, which the threat actor planned to leverage.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“ThreatLocker had blocked the solutions that the threat actor had planned on leveraging, such as AnyDesk and rclone”
ThreatLocker hospital ransomware incident INVOLVES rclone
ThreatLocker blocked rclone, which the threat actor planned to leverage.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“such as AnyDesk and rclone”
ThreatLocker hospital ransomware incident INITIAL_ACCESS_VIA VPN
The threat actor obtained domain-administrator credentials from the dark web and used them to remotely access the environment through the VPN.
Explicit Confidence 99% · Hunter Clark EP 167 Details
“was able to just remote in through the VPN”
ThreatLocker hospital ransomware incident INVOLVES Windows
The threat actor gained access to a Windows server and attempted to infect it with ransomware.
Explicit Confidence 97% · Jack Rhysider EP 167 Details
“gained access to a Windows server, tried to infect it with ransomware”
ThreatLocker hospital ransomware incident INVOLVES Ransomware
The hospital incident involved an attempted ransomware infection and ultimately a ransom demand and payment.
Explicit Confidence 98% · Jack Rhysider EP 167 Details
“tried to infect it with ransomware, but ThreatLocker denied it”
“this hospital system did end up paying the ransom”