(Natasaadzic via Getty)
UPDATE 6/13: The attack on Ascension has been traced to a malicious file that ended up on an employee's computer.
Original Story:
The US is warning about the Black Basta ransomware gang amid reports that the group is behind the hack at healthcare provider Ascension.
On Friday, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) said the Black Basta gang is targeting US critical infrastructure, including the healthcare sector. It adds that Black Basta—believed to be operating out of Russia—is known to hack victims by using spear-phishing emails and exploiting known software vulnerabilities, such as recent flaws found in remote IT management software ConnectWise.
The federal agencies didn’t say what prompted the warning. But it arrives as private hospital operator Ascension has been fending off a cyberattack that began on Wednesday.
Ascension hasn't identified the hackers, but CNN reports that ransomware from the Black Basta gang was used in the hack, citing four sources briefed on the investigation.
The incident is another disturbing reminder of how ransomware groups are able to disrupt access to US healthcare providers. In February, a separate gang called ALPHV/Blackcat managed to spread ransomware to a subsidiary of health insurance provider UnitedHealth Group, which led to major delays at hospitals and pharmacies across the country.
UnitedHealth Group also resorted to paying the hackers a $22 million ransom payment, which did little to help the company recover from the attack or prevent the hackers from stealing and potentially leaking patient information.
"This marks a worrying trend," said Steve Hahn, an Executive VP at cybersecurity provider BullWall. He notes that the FBI has been stepping up its efforts to take down Russian ransomware groups, such as LockBit and ALPHV. But these actions have also emboldened Russian cybercriminals to hit back at US critical infrastructure.
In Ascension’s case, the cyberattack has disrupted access to some IT systems and clinical operations. “Systems that are currently unavailable include our electronic health records system, MyChart (which enables patients to view their medical records and communicate with their providers), some phone systems, and various systems utilized to order certain tests, procedures and medications,” the hospital operator said in a Thursday update.
In addition, several Ascension hospitals have been forced to divert “emergency medical services in order to ensure emergency cases are triaged immediately,” it said.
Whether Ascension has received or will pay the ransom demand remains unclear. The healthcare provider didn’t immediately respond to a request for comment. So far, Black Basta’s site on the dark web has not listed any information about the Ascension attack.