North Korean hackers target US healthcare providers with ransomware

North Korean state-funded hackers have carried out attacks against health insurance companies since May 2021, according to the US government. They use ransomware, a method that has grown in recent years.

The FBI, the Cyber ​​and Infrastructure Security Agency, as well as the Tsauro Department, have issued a joint statement warning companies about the way criminals operate.

Hackers use ransomware called Maui to encrypt the computers of health insurance companies and then demand payments from the victim to unlock their information. The statement from US agencies provides information about malware, such as signs of hardware contamination and techniques criminals use to spread it, based on a sample collected by the FBI.

The agencies claim that hackers shut down health records, diagnostic services, imaging, and the intranet, among other things. In some cases, criminals have managed to completely banish carriers from their systems and completely disable services for extended periods.

The malware is manually executed remotely once the victim’s network is infected. The agencies do not encourage paying ransomware because there is no guarantee that hackers will open the information in the files. However, they acknowledge that criminals will continue to target health insurance companies because their information is important.

The US government is seeking emergency measures to use mitigation techniques and prepare for ransomware attacks, such as installing software updates, and keeping backup data offline.

Earlier, a United Nations report revealed that North Korean hackers are using funds from these attacks to fund the country’s nuclear and missile program.