Group-IB x Healthcare Provider Success Story

Introduction

The healthcare sector has undergone a massive digital transformation over the past decades. Patient information, medical services, and associated transactional processes are now more accessible and efficient for global patients through websites and applications.

The rapid expansion of data generated online — in both volume and frequency — has made storage, transmission, and analysis easier, but medical information available online needs to be subjected to strict cyber oversight and protection to avoid tampering, leaks, and other cyber threats.

To enable proactive cybersecurity, healthcare providers must continuously assess and monitor risk indicators, alerts, and other signals generated by their entire technology infrastructure to stop threats in real- time. Overlooking security blind spots can significantly weaken an organization’s security posture. Such was the case with one of the fastest-growing healthcare providers in Malaysia — who was blinded by the very challenge when a cyber threat escalated into a full-blown attack, prompting them to seek the expertise of a global cybersecurity service provider like Group-IB.

The Malaysian private healthcare provider operates with a high- responsibility mission to save lives, and any delays or disruptions could have catastrophic consequences — an outcome the healthcare provider was determined to avoid. The cyber threat delayed patient care, creating a critical and immediate need to act. Given its high-stakes mission, the provider responded quickly with the help of experts and compensated the threat actor to regain access to sensitive files.

Initial pain points:

• A ransomware threat from a threat actor previously tracked and researched by Group-IB
• Limited context in Threat Intelligence, with no clear indicators of cyber threats, ultimately leaving the healthcare provider vulnerable to ransomware attacks
• Subpar risk advisory services
• Weak incident response strategy with no Plan of Action (POA) at the time of the attack, leading to delays in Mean Time to Recovery (MTTR) and inadequate support for takedowns
• The organization had a traditional and legacy security stack that lacked the necessary capabilities and visibility to defend against modern cyber threats
• Lack of visibility into current and emerging vulnerabilities in their network infrastructure, resulting in security gaps
• Insufficient critical insights to evaluate and improve the cybersecurity posture

Choice of Cyber Arsenal To Eliminate The Active Threat and Improve Posture

TIn the previous cyber incident, the threat actor’s initial access to the healthcare provider’s network was via the provider’s VPN. At that time, the healthcare provider was using a Fortinet VPN solution. Unfortunately, during that time period, Fortinet Cyber Security Company had a breach that affected a few clients who resided in Malaysia. The consequences of the breach caused Fortinet clients’ VPN access/credentials to be sold on the dark web.

The investigation and incident response performed by Group-IB experts concluded that the threat actor had used the VPN credentials purchased from the dark web. The healthcare provider didn’t take action when Fortinet was breached because of the absence of threat intelligence advisory and notification.

On January 31, 2024, a threat actor known as “yesdaddy” posted about selling Forti-VPN access to multiple victims, including two Malaysian companies. That same day, a user named “MSSP” initiated an auction for this access pack. By February 2, 2024, another post confirmed that the access was sold through personal messages.

Image source: Post on the dark web made by threat actor for Forti-VPN access

Given the timing, Malaysian context, and the Forti-VPN access, the Group-IB Threat Intelligence team suspected the healthcare provider’s VPN access was likely sold on the dark web.

Results?

Conclusion

This collaboration study highlights a strong partnership that enabled a strategic response to the ransomware attack followed by a comprehensive network audit and gap analysis, strengthening cybersecurity for the private healthcare provider. Group-IB’s industry- leading team, with over 1,550+ global investigations and 70,000 hours of incident response experience, leveraged patented technologies and investigative expertise to swiftly resolve the crisis, identify potential vulnerabilities and ensure capabilities were in place to address any emerging risks in the infrastructure immediately.

These strengths made Group-IB the top choice for Malaysia’s rapidly growing healthcare provider, with the team citing Group-IB’s solutions, expertise, experience, proven track record in cybersecurity, and unique knowledge about the particular threat actor as the primary reasons.