US disrupts North Korean hackers that targeted hospitals

Jul 19, 2022, 7:26 AM | Updated: Jul 22, 2022, 8:46 am

NEW YORK (AP) — The FBI and Justice Department recently disrupted the activities of a hacking group that was sponsored by the North Korean government and that targeted U.S. hospitals with ransomware, ultimately recovering half a million dollars in ransom payments and cryptocurrency, Deputy Attorney General Lisa Monaco said Tuesday.

Monaco revealed new details of the attacks during a speech in which she encouraged organizations hit by ransomware to report the crime to law enforcement, both so that officials can investigate and so that they can help victim companies try to get ransom payments back.

In this case, Monaco said, a Kansas hospital that paid a ransom last year after being attacked by ransomware also contacted the FBI, which traced the payment and identified China-based money launderers who assisted the North Korean hackers in cashing out the illicit proceeds. The FBI was able to recover half a million dollars, including the entire ransom payment from the hospital.

“If you report that attack, if you report the ransom demand and payment, if you work with the FBI, we can take action,” Monaco said at the International Conference on Cyber Security, hosted by Fordham University. “We can follow the money and get it back; we can help prevent the next attack, the next victim; and we can hold cybercriminals accountable.”

U.S. officials in 2021 scrambled to confront a wave of high-profile ransomware attacks — in which hackers encrypt or lock up a victim’s data and demand exorbitant sums to return it — including against a crucial fuel pipeline on the East Coast. Though the pace of such large-scale, front-page attacks seems to have slowed, smaller targets — such as hospitals — continue to be affected.

FBI Director Christopher Wray said at the same conference that a particular challenge is that ransomware, once largely the province of garden-variety cyber criminals looking to extort cash, is now being increasingly deployed by hostile governments who are eager for destruction.

“The other thing we’re seeing more and more of is ransomware actors doing more than just locking up the system,” Wray said. “They’re exfiltrating the information, they’re threatening to release your proprietary information.”

This particular variant of ransomware, known as “Maui,” specifically targeted hospitals and public health organizations around the country.

Justice Department officials say the attack on the Kansas hospital, which they did not identify, took place in May 2021 when hackers encrypted the medical center’s files and servers. The hospital paid about $100,000 in Bitcoin to get its data back.

The department said that in addition to recovering the payment from the Kansas hospital, it also got back a payment from a health care provider in Colorado that was affected by the same Maui ransomware variant.

____

Follow Eric Tucker at http://www.twitter.com/etuckerAP

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

AP

(Facebook Photo/City of San Luis, Arizona)...
Associated Press

San Luis authorities receive complaints about 911 calls going across border

Authorities in San Luis say they are receiving more complaints about 911 calls mistakenly going across the border.
4 days ago
(Pexels Photo)...
Associated Press

Daylight saving time begins in most of US this weekend

No time change is observed in Hawaii, most of Arizona, Puerto Rico, the U.S. Virgin Islands, American Samoa, Guam and the Northern Marianas.
12 days ago
Mexican army soldiers prepare a search mission for four U.S. citizens kidnapped by gunmen in Matamo...
Associated Press

How the 4 abducted Americans in Mexico were located

The anonymous tip that led Mexican authorities to a remote shack where four abducted Americans were held described armed men and blindfolds.
12 days ago
Tom Brundy points to a newly built irrigation canal on one of the fields at his farm Tuesday, Feb. ...
Associated Press

Southwest farmers reluctant to idle farmland to save water

There is a growing sense that fallowing will have to be part of the solution to the increasingly desperate drought in the West.
19 days ago
A young bison calf stands in a pond with its herd at Bull Hollow, Okla., on Sept. 27, 2022. The cal...
Associated Press

US aims to restore bison herds to Native American lands after near extinction

U.S. officials will work to restore more large bison herds to Native American lands under a Friday order from Interior Secretary Deb Haaland.
19 days ago
Children play in a dried riverbed in Flassans-sur-Issole, southern France, Wednesday, March 1, 2023...
Associated Press

Italy, France confront 2nd year of western Europe drought

ROME (AP) — Bracing for Italy’s second consecutive year of drought for the first time in decades, Premier Giorgia Meloni huddled with ministers Wednesday to start mapping out an action plan Wednesday, joining France and other nations in western Europe grappling with scant winter rain and snow. Meloni and her ministers decided to appoint an […]
21 days ago

Sponsored Articles

(Photo by Michael Matthey/picture alliance via Getty Images)...
Cox Communications

Valley Boys & Girls Club uses esports to help kids make healthy choices

KTAR’s Community Spotlight focuses on the Boys & Girls Club of the Valley and the work to incorporate esports into children's lives.
...
Fiesta Bowl Foundation

Celebrate 50 years of Vrbo Fiesta Bowl Parade magic!

Since its first production in the early 1970s, the Vrbo Fiesta Bowl Parade presented by Lerner & Rowe has been a staple of Valley traditions, bringing family fun and excitement to downtown Phoenix.
(Desert Institute for Spine Care photo)...
DESERT INSTITUTE FOR SPINE CARE

Why DISC is world renowned for back and neck pain treatments

Fifty percent of Americans and 90% of people at least 50 years old have some level of degenerative disc disease.
US disrupts North Korean hackers that targeted hospitals