Security News > 2021 > October > FIN12 hits healthcare with quick and focused ransomware attacks
FIN12 is a prolific threat actor with a strong focus on making money that executes ransomware attacks since at least October 2018.
FIN12 is characterized by skipping the data exfiltration step that most ransomware gangs have adopted to increase their chances of getting paid.
FIN12 are known for their preference for deploying Ryuk ransomware but the gang also used Conti, Ryuk's successor, in at least one attack investigated by Mandiant.
The researchers say that FIN12 also engaged in other ransomware incidents that involved data theft using Ryuk.
In a profile of the group published today by cybersecurity company Mandiant, researchers note that many FIN12 victims are in the healthcare sector.
Organizations in the healthcare sector have been a constant target for FIN12, even during the Covid-19 pandemic, as almost 20% of the FIN12 attacks that Mandiant observed were against entities in this industry.
News URL
Related news
- Kidney dialysis firm DaVita hit by weekend ransomware attack (source)
- Ahold Delhaize confirms data theft after INC ransomware claims attack (source)
- Interlock ransomware gang pushes fake IT tools in ClickFix attacks (source)
- Interlock ransomware claims DaVita attack, leaks stolen data (source)
- Ransomware attacks are getting smarter, harder to stop (source)
- Hitachi Vantara takes servers offline after Akira ransomware attack (source)
- Marks & Spencer breach linked to Scattered Spider ransomware attack (source)
- Ukrainian extradited to US for Nefilim ransomware attacks (source)
- US indicts Black Kingdom ransomware admin for Microsoft Exchange attacks (source)
- Co-op confirms data theft after DragonForce ransomware claims attack (source)