Security News > 2021 > October > Suspected Chinese hackers behind attacks on ten Israeli hospitals
A joint announcement from the Ministry of Health and the National Cyber Directorate in Israel describes a spike in ransomware attacks over the weekend that targeted the systems of nine health institutes in the country.
In the joint announcement, the Israeli government states that the attempts resulted in no damage to the hospitals and the medical organizations, thanks to national-level coordination and the quick and decisive response of the local IT teams.
According to local media reports, the attack is attributed to a Chinese group of actors using the 'DeepBlueMagic' ransomware strain, which first appeared in the wild in August this year.
DeepBlueMagin is known to disable security solutions that usually detect and block file encryption attempts, allowing for successful attacks.
Israel's National Cyber Directorate has released indicators of compromise in the form of file hashes that have been seen in related attacks.
Reuven Eliyahu, the cybersecurity chief in the Health Ministry, has confirmed that the mid-week attack was carried out by Chinese hackers in a statement today and described the actors' motives as "Purely financial."
News URL
Related news
- Chinese hackers targeted sanctions office in Treasury attack (source)
- Chinese hackers use Visual Studio Code tunnels for remote access (source)
- US sanctions Chinese firm for hacking firewalls in ransomware attacks (source)
- US sanctions Chinese cybersecurity company for firewall compromise, ransomware attacks (source)
- US names Chinese national it alleges was behind 2020 attack on Sophos firewalls (source)
- U.S. Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls (source)
- US Sanctions Chinese Cybersecurity Firm for 2020 Ransomware Attack (source)
- 390,000 WordPress accounts stolen from hackers in supply chain attack (source)
- Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks (source)
- Russian hackers use RDP proxies to steal data in MiTM attacks (source)