CasesS=1:500S=1:100
Okayama Psychiatric Medical Center ransomware: the way in
A maintenance SSL-VPN appliance with a guessable password, no updates since 2018 and no source-IP limit was the way in.
1 Summary
At about 16:00 on Sunday, May 19, 2024, the hospital's electronic medical records stopped working. The next morning the vendor found ransomware. Forensics later showed that the intruder had been inside since 02:41 on May 13. Personal data of up to 40,000 people was leaked. The investigation committee placed the entry at the maintenance SSL-VPN appliance in the data center.
Probable cause: A maintenance SSL-VPN appliance with a guessable password, no updates since 2018 and no source-IP limit was the way in.
Source: Software ISAC, Okayama Psychiatric Medical Center investigation committee 「ランサムウェア事案調査報告書」 (pp.12–13, 16–17, 20–21, 30–31)
S=1:100 2 Factual information
2.1 The way in
The committee: the maintenance VPN appliance had no source-IP restriction, so "anyone on the internet could attack it." It lists three possible causes: a dictionary attack on the SSL-VPN, credentials bought from an initial access broker, or exploitation of an SSL-VPN vulnerability.
Source: Software ISAC, Okayama Psychiatric Medical Center investigation committee 「ランサムウェア事案調査報告書」 (pp.12–13, 16–17, 20–21, 30–31)
- Product
- Cisco ASA 5506-X (SSL-VPN for maintenance)
- CVE
- Not stated
2.2 After entry
For about six days the intruder scanned the network, searched for and destroyed backups, took user and computer information from Active Directory, stopped and deleted antivirus, and copied Office documents from shared folders. Encryption ran from 13:10 to 17:34 on May 19: 23 virtual servers, the shared storage, 3 virtualization hosts, 6 other physical servers and 244 terminals. All data on the shared storage was lost. The contracted offline backup had not been taken correctly.
2.3 Damage
Medical records went down at the hospital and its clinic. Staff used paper charts and care did not stop. Okayama Prefectural Police confirmed a leak of personal data, estimated at up to 40,000 people, including names, addresses, dates of birth and diagnoses. Full recovery took about three months, using a data-warehouse server that had escaped encryption.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2024-05-13 02:41 | Intruder | First confirmed entry. Daily network scans, theft of Active Directory data and shared-folder data, and a search for backups follow until May 18. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| 2024-05-14 22:56 | Intruder | Remote logon to an Active Directory server; a network scanner is installed. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| 2024-05-16 | Intruder | From May 16 to 18, credentials taken from the Active Directory server and backup data deleted. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| 2024-05-19 13:10 | Intruder | Encryption of servers and terminals begins; it ends at 17:34. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| c. 2024-05-19 16:00 | Hospital | Staff find the medical records stopped and call the vendor. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| c. 2024-05-20 06:15 | Vendor | Finds files with a suspicious extension in the backups; ransomware confirmed. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| c. 2024-05-20 07:00 | Hospital | Task force decides to continue inpatient and outpatient care on paper charts. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| 2024-05-20 16:00 | Hospital | Announces on its website that the medical records are down after a cyberattack. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| 2025-02-13 | Investigation committee | Investigation report published. | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| The SSL-VPN's ID and password were guessable, and the same pair was the Windows administrator credential on every machine. | Stated | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| No source-IP restriction was set on the maintenance VPN appliance. | Stated | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| First entry is confirmed at 02:41 on May 13, 2024, from server forensics. | Stated | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| Which of the three causes applied: a dictionary attack, bought credentials, or a vulnerability. | Presumed | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| The VPN appliance's own record. Its syslog was kept only in a small in-memory buffer and had been overwritten. | Unknown | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
S=1:100 4 Conclusions
The committee concluded that the intruder came in through the maintenance SSL-VPN appliance, then used the same administrator credentials everywhere to spread, steal data and encrypt. It wrote that most of the weaknesses could easily have been prevented by following the health ministry's guideline.
S=1:100 5 Recommendations
Recommended or carried out by: Hospital (measures implemented, as listed in the committee's report)
- Replace the VPN with a service that has multi-factor authentication and source restriction.
- Stop using the built-in Administrator; give every administrator a unique ID with a password of 16 or more characters.
- Restrict Remote Desktop by source and set lockout.
- Run the medical-record system with standard user accounts.
- Renew the firewall in front of vendors' own VPN appliances and restrict their source IPs.
- Lock an account after five consecutive failed logins.
Source: Software ISAC, Okayama Psychiatric Medical Center investigation committee 「ランサムウェア事案調査報告書」 (pp.12–13, 16–17, 20–21, 30–31)
Sources
Source: Software ISAC, Okayama Psychiatric Medical Center investigation committee 「ランサムウェア事案調査報告書」 (pp.12–13, 16–17, 20–21, 30–31)