Server-side Ransomware SAMSAM Hits Healthcare Industry

Shortly after Locky—a new ransomware strain—was reported to have been responsible for an attack on a Kentucky hospital, a new ransomware family dubbed SAMSAM was discovered targeting the healthcare industry yet again. According to findings by Cisco Talos, SAMSAM is installed once the attackers exploit vulnerable servers, making it unique because unlike traditional ransomware, it does not rely on malvertising, or social engineering techniques such as malicious email attachments, for delivery. This particular ransomware variant appears to be distributed via unpatched servers and uses them to compromise additional machines which the hackers use to identify key data systems to encrypt—notably targeting the healthcare industry.

[READ: Locky Ransomware Strain Hits Methodist Hospital]

The attackers are leveraging JexBoss, an open source application server, and other Java-based application platforms by using exploits to get remote shell access to the server itself and install SAMSAM onto the targeted Web application server. The infected server is then used to spread the ransomware client to Windows machines by moving laterally through the network. Interestingly, victims are able to communicate with the attackers, and, as observed by Cisco Talos, a dialogue allows the victims and the perpetrator to negotiate the types of payment options available to the victims. As seen in some samples, a price of 1.5 bitcoin for a single system, or an option for bulk decryption of 22 bitcoin to decrypt all infected systems was being offered.

[How does ransomware work?]

The SAMSAM ransomware variant is reminiscent of, or based on SAMAS, a crypto-ransomware family known for its ability to encrypt files not only on the system it infects but also files across networks, including network-based backups. An alert released by the FBI also cautioned that the threat actors behind SAMAS are also taking advantage of the malware’s capability to “manually locate and delete” the backups, ultimately coercing businesses to either pay up or suffer critical data loss. This sort of ransomware attack behaves almost like a targeted attack, wherein the attacker chooses its targets and has discrete control over what happens, as opposed to more common crypto-ransomware variants that are automated.