Alert Targets FiveHands Ransomware Attacks

Healthcare IT managers seeking guidance and support in their efforts to protect thor organization’s patient and research data against ongoing waves of cyber attacks have a new resource in the form of an alert from the Cybersecurity and Infrastructure Security Agency (CISA).

CISA recently issued the alert, which provides more details on the threat posed by FiveHands ransomware attacks, according to GovInfo Security. The CISA alert, which follows one issued recently by FireEye's Mandiant research team, describes the ransomware gang's methods and offers risk mitigation tips.

"Threat actors used publicly available penetration testing and exploitation tools, FiveHands ransomware and the SombRAT remote access Trojan, to steal information, obfuscate files and demand a ransom from the victim organization," CISA says. The group has mainly targeted businesses in healthcare, telecommunications, construction, engineering, food and beverage, education, and real estate.

CISA offers recommendations to protect against FiveHands and other ransomware, including these:

• Maintain up-to-date antivirus signatures and engines.
• Keep operating system patches up to date.
• Restrict users' ability to install and run unwanted software applications.