Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released a sector survey report, “The State of Ransomware in Healthcare 2024,” which revealed that the rate of ransomware attacks against healthcare organizations has reached a four-year high since 2021. Of those organizations surveyed, two-thirds (67%) were impacted by ransomware attacks in the past year, up from 60% in 2023.

The rising rate of ransomware attacks against healthcare institutions contrasts with the declining rate of ransomware attacks across sectors; the overall rate of ransomware attacks fell from 66% in 2023 to 59% in 2024.

Alongside an increase in the rate of ransomware attacks, the healthcare sector reported increasingly longer recovery times. Only 22% of ransomware victims fully recovered in a week or less, a considerable drop from the 47% reported in 2023 and 54% in 2022.

In addition, 37% took more than a month to recover, up from 28% in 2023, reflecting the increased severity and complexity of attacks.

“While we’ve seen the rate of ransomware attacks reach a kind of “homeostasis” or even declining across industries, attacks against healthcare organizations continue to intensify, both in number and scope.

“The highly sensitive nature of healthcare information and need for accessibility will always place a bullseye on the healthcare industry from cybercriminals.

“Unfortunately, cybercriminals have learned that few healthcare organizations are prepared to respond to these attacks, demonstrated by increasingly longer recovery times.

“These attacks can have immense ripple effects, as we’ve seen this year with major ransomware attacks impacting the healthcare industry and impacting patient care,” said John Shier, field CTO, Sophos.

“To combat these determined adversaries, healthcare organizations must adopt a more proactive, human-led approach to threat detection and response, combining advanced technology with continuous monitoring to stay ahead of attackers.”

Additional findings from the report include:

·       Ransom Recovery Costs Surge: The mean cost of recovery in a healthcare ransomware attack was $2.57 million in 2024, up from $2.2 million in 2023 and double the 2021 cost

·       Ransom Demands vs Payments: 57% of healthcare institutions that paid the ransom ended up paying more than the original demand

·       Root Cause of Attack: Compromised credentials and exploited vulnerabilities were tied for the number one root cause of attack, each accounting for 34% of attacks

·       Backups Targeted: 95% of healthcare organizations hit by ransomware in the past year said that cybercriminals attempted to compromise their backups during the attack.

·       Increased Pressure: Organizations whose backups were compromised were more than twice as likely to pay the ransom to recover encrypted data (63% vs. 27%)

·       Who Pays the Ransom: Insurance providers are heavily involved in ransom payments, contributing in 77% of cases. 19% of total ransom payment funding comes from insurance providers.

The latest Sophos report on real-world ransomware experiences explores the full victim journey, from attack rate and root cause to operational impact and business outcomes, of 402 healthcare organizations.

The results for this sector survey report are part of a broader, vendor-agnostic survey of 5,000 cybersecurity/IT leaders conducted between January and February 2024 across 14 countries and 15 industry sectors.

Learn More About Ransomware

• Turning the screws: The pressure tactics of ransomware gangs
  
• The State of Ransomware 2024
• The effect of cyber insurance on the ransomware landscape
• The role of law enforcement in ransomware attacks
• The role of unpatched vulnerabilities in ransomware attacks
• How often companies’ backupsare compromised during ransomware attacks
• The rise of remote encryption among ransomware groups
• Ransomware attackers targeting managed service providers (MSPs) in the 2024 Sophos Threat Report: Cybercrime on Main Street
• The latest techniques, tactics and procedures (TTPs) of cyber attackers in the Active Adversary Report for 1H 2024
• The evolving ransomware business model in Junk Gun’ Ransomware: Peashooters Can Still Pack a Punch
• Sophos X-Ops and its groundbreaking threat research by subscribing to the Sophos X-Ops blogs

An executive bill seeking to amend the National Identity Management Commission (NIMC) Act is to be forwarded by President Bola Tinubu to the National Assembly.

The bill aims to provide that everybody living in Nigeria, including foreigners must be registered and given the National Identity Number (NIN) so that they can be taxed.

Bayo Onanuga, special adviser to the President on Information and Strategy, revealed this in a statement in Abuja on Wednesday alongside O’tega Ogra, senior special assistant to the President on Digital Strategy, Engagement and Communications.

This is part of the economic stabilization bills approved during the Federal Executive Council meeting held on Monday.

Onanuga said the economic stabilisation bills which are about twenty in number also include bills to amend the Acts establishing the Nigerian Port Authority and the Nigerian Maritime Administration and Safety Agency (NIMASA).

According to him, the two bills seek to ensure transactions by the two agencies are paid for in Naira.

He said the decision is part of measures by Tinubu’s administration to promote the national currency and reduce the dollarization of Nigeria’s economy.

In late August 2024, Kaspersky experts identified a new version of the Necro Trojan that had infiltrated several popular applications on Google Play and modified applications on unofficial platforms, including Spotify, WhatsApp and Minecraft.

Necro is an Android downloader that downloads and runs other malicious components on infected devices based on commands issued by the Trojan’s creators. Kaspersky’s solutions recorded* Necro attacks targeting users in Russia, Brazil, Vietnam, Ecuador, and Mexico as part of this malicious campaign.

Capabilities of the Necro Trojan 

The variant of Necro discovered by Kaspersky experts can download modules onto infected smartphones that display ads in invisible windows and click on them, download executable files, install third-party applications, and open arbitrary links in invisible WebView windows to execute JavaScript code.

Based on its technical characteristics, the Trojan is also likely capable of subscribing users to paid services. Additionally, the downloaded modules allow attackers to redirect Internet traffic through the victim’s device. This enables cybercriminals to visit prohibited or desired resources using the victim’s device, potentially utilising it as part of a proxy botnet.

Infected Apps on Unofficial Platforms

The first discovery of Necro by company’s experts was in a modified version of Spotify Plus. The creators of the app claimed that it was safe for devices and offered additional features not found in the official music streaming app.

Subsequently, experts also found a modified version of WhatsApp containing the Necro downloader, followed by infected versions of popular games, including Minecraft, Stumble Guys, and Car Parking Multiplayer. Necro was embedded into these applications via an unverified ad module.

Infected Apps on Google Play

The Necro campaign extended beyond third-party platforms and was also discovered on Google Play. The malicious downloader was found in the Wuta Camera app and Max Browser.

According to Google Play statistics, the combined downloads of these apps exceeded 11 million. On this platform, Necro was also distributed via an unverified ad module. Following Kaspersky’s report to Google, the malicious code was removed from Wuta Camera, and Max Browser was taken down from the store. However, users still risk encountering Necro on unofficial platforms.

“Users often download unofficial, modified apps to bypass restrictions in official applications or to access additional free features. Cybercriminals exploit this behaviour, spreading malware with these apps as there is no moderation on third-party platforms,” comments Dmitry Kalinin, cybersecurity expert at Kaspersky.

“It is also noteworthy that the version of Necro embedded in these applications used steganography techniques, hiding its payload within images to remain undetected – a very rare method for mobile malware.”