The Cybersecurity and Infrastructure Security Agency (CISA) reported that it had assisted numerous hospitals in responding to a series of distributed denial-of-service (DDoS) attacks last week, which were launched by a pro-Kremlin hacking group known as Killnet. A spokesperson for CISA told The Record that some of the incidents caused temporary disruptions to the availability of the hospitals' public-facing websites, but there were no reports of unauthorized access to hospital networks, disruption to health care delivery, or impacts on patient safety. Killnet has been launching DDoS attacks on governments and companies in Europe and the U.S. for months, and recently targeted U.S. hospitals. On their Telegram channel, the hackers claimed to have launched DDoS attacks on hospitals in more than 25 states. CISA reported that less than half of the attacks were successful in taking the websites offline. The agency has made DDoS incidents a priority issue, and is working with partners to help organizations protect themselves. CISA is also providing free resources to under-funded organizations to help them reduce the impact of DDoS attacks. Cybersecurity firm Cloudflare reported that hospitals have been reaching out for help in addressing Killnet's DDoS campaign. Cloudflare experts said the attacks are not coming from a single botnet, which could indicate the involvement of multiple threat actors or a more sophisticated, coordinated attack. The largest attack on a hospital reached 1.6 million requests per second, which would degrade services and affect application usability. The U.S. Department of Health and Human Services (HHS) has issued an alert warning healthcare institutions that some DDoS incidents may lead to ransomware attacks. Since Russia began its invasion of Ukraine 11 months ago, hacking groups like Killnet and NoName057 have been targeting a variety of government institutions, businesses, and organizations across Europe and the U.S. Akamai published a report last week that found DDoS incidents in Europe had increased significantly in 2022, with more campaigns now involving extortion tactics. The company also warned that DDoS attacks are now increasingly being used as cover for actual intrusions involving ransomware and data theft.
This Cyber News was published on therecord.media. Publication date: Tue, 07 Feb 2023 21:17:02 +0000