Security News > 2021 > May > FBI: 16 Conti Ransomware Attacks Targeted Healthcare, First Responders in U.S.

The FBI says it has observed 16 Conti ransomware attacks that targeted healthcare and first responder networks in the United States over the past year.

First detailed in July 2020, Conti has grown to become a major threat, with more than 400 organizations worldwide being hit by the ransomware to date.

Conti operators steal victim data in addition to encrypting files on servers and workstations, threatening to release the stolen data to the public unless the ransom is paid.

U.S. healthcare organizations and first responders that Conti has hit since its emergence include 9-1-1 dispatch centers, emergency medical services, law enforcement agencies, and municipalities, the FBI reveals in a newly published alert.

A typical Conti attack starts with the malicious document dropping Cobalt Strike and Emotet, with the attackers dwelling in the victim's network between four days and three weeks on average before installing the ransomware.

The FBI also notes that the ransomware operators use remote access tools that communicate over ports 80, 443, 8080, and 8443, that they employ cloud-based data storage providers MegaNZ and pCloud for large HTTPS transfers, and that they disable endpoint detection systems.

News URL

http://feedproxy.google.com/~r/securityweek/~3/cohOQYIoRUw/fbi-16-conti-ransomware-attacks-targeted-healthcare-first-responders-us