While the well-known ransomware strains LockBit and Conti regularly plague the healthcare sector, a new North Korean-backed entry dubbed Maui is garnering enough attention that three federal agencies have jointly issued a communique regarding its danger to U.S. Healthcare and Public Health (HPH) organizations.
The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. Treasury Department recently issued a joint advisory warning of North-Korean-backed threat actors using the little known Maui ransomware in attacks against HPH facilities. The FBI said it has been involved in dampening multiple ransomware attacks in which the perpetrators used the Maui strain to hobble HPH facilities in the U.S.
Maui's Unknown Destructive Potential
One way Maui hackers differ from other attackers is there is no ransom note with instructions for victims to restore their data. The remote hackers are said to deploy the malware manually across networks to pick and choose which files to hijack. At this point, Maui’s destructive potential is not clearly known.
The federal agencies issued a warning in the bulletin:
"North Korean state-sponsored cyber actors used Maui ransomware in these incidents to encrypt servers responsible for healthcare services — including electronic health records services, diagnostics services, imaging services, and intranet services. In some cases, these incidents disrupted the services provided by the targeted HPH Sector organizations for prolonged periods. The initial access vector(s) for these incidents is unknown."
Paying Ransom Discouraged
The three U.S. federal agencies also provided indicators of compromise (IOCs) obtained by the FBI while responding to Maui ransomware attacks since May 2021, as well as mitigation recommendations. They strongly discourage paying ransoms because doing so does not guarantee victims’ files will be restored and may run sideways from Department of Treasury sanctions linked to such payments.
The FBI said it is seeking any information that can be shared regarding Maui, to include boundary logs showing communication to and from foreign IP addresses, bitcoin wallet information, the decryptor file, and/or benign samples of encrypted files.
It’s not the first time the U.S. has run into North Korean-state sponsored hackers for attacking healthcare organizations. Five years ago, the U.S. and U.K. accused the rogue state of springing the WannaCry malware to severely disrupt healthcare and other sectors worldwide.
How to Avoid a Maui Attack
The FBI, CISA, and Treasury recommend HPH sector organizations deploy these nine mitigations to avoid a Maui attack:
