UNC1878 Continues to Infect Hospital Networks

8 February 2021

Last October, a threat actor known as UNC1878 made headlines for a widespread criminal campaign targeting the healthcare industry (and other organizations) around the world.

Over three months have passed since this group’s activities became widely known, yet in spite of high public awareness, many of UNC1878’s victims remain actively compromised to this day.

Prevailion’s APEX Platform continues to observe active beaconing by UNC1878 malware from prominent hospitals and healthcare providers in the United States, as well as other countries. These unmitigated compromises are concerning due to the sensitive nature of hospital networks.

Ongoing UNC1878 activity in a southern US hospital. (Source: APEX)

Due to the high level of persistent malware beacon activity observed, these healthcare organizations are at risk not only of an imminent encryption attack by Ryuk or other ransomware families, but they are also at risk of ongoing data exfiltration by this Russian threat actor.

The APEX Platform has also observed active beaconing by as yet unidentified malware or toolkits deployed by UNC1878 in these network environments.

Unidentified malware activity by UNC1878 in another US hospital. (Source: APEX)

Since the risks posed by UNC1878 are significant, ranging from sensitive information theft to high-priced extortion and service disruption, it is imperative for all healthcare organizations to thoroughly examine their networks for any IOCs by this threat actor.

Prevailion continues to provide free access to the APEX Platform for any organization that would like to check its own network for compromise activity by UNC1878 or other threat actors.

The Latest

DarkWatchman: A new evolution in fileless techniques.

Authored by: Matt Stafford and Sherman Smith Executive summary: In late November, Prevailion’s Adversarial Counterintelligence Team (PACT) identified what appeared to be a malicious javascript-based Remote Access Trojan (RAT) that uses a robust Domain Generation Algorithm (DGA) to identify its Command and Control (C2) infrastructure and that utilizes novel methods for fileless persistence, on-system activity, […]

Shopping online safely with Karim Hijazi – WWL First News with Tommy Tucker

Tommy talks with Karim Hijazi, CEO of Prevailion.

SNIPPET – Live DNS Security Validation

IS YOUR CYBER SECURITY FAILING? See if your company, your competitors or even your next M&A target has failing security controls. Fedex Elevated There are previous or recent attempted communications with threat actor infrastructure. There is high confidence that the communication has a malicious origin. (see JS) Tell Me More About Security Validation

Copyright 2022 Prevailion, Inc. All rights reserved.    

Disclaimer: Gartner “Cool Vendors in Security Operations and Threat Intelligence,” Mitchell Schneider, Ruggero Contu, John Watts, Craig Lawson, October 13, 2020. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner Disclaimer: The GARTNER COOL VENDOR badge is a trademark and service mark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.