Medicare Compliance & Reimbursement

As 2022 winds down, another cyber threat looms — and this one seems especially dangerous for the healthcare sector.

Nuts and bolts: On Nov. 17, the Department of Health and Human Services (HHS), the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint cybersecurity advisory (CSA) about the Hive ransomware.

Since the feds noticed its entrance on the cybersecurity spectrum in June 2021, Hive ransomware has impacted more than 1,300 companies and collected $100 million in ransomware payments worldwide.

“Hive ransomware follows the ransomware-as-a-service (RaaS) model in which developers create, maintain, and update the malware, and affiliates conduct the ransomware attacks,” the advisory says. “Hive actors have gained initial access to victim networks by using single factor logins via Remote Desktop Protocol (RDP), virtual private networks (VPNs), and other remote network connection protocols. In some cases, Hive actors have bypassed multifactor authentication (MFA) and gained access to FortiOS servers by exploiting Common Vulnerabilities and Exposures (CVE),” the CSA adds.

Read the advisory for more details on the attack and how to combat the infiltration at www.cisa.gov/uscert/ncas/alerts/ aa22-321a.