When a ransomware attack happens, companies and insurers seek out specialty operators, firms that are often clandestine but experts in dealing with these criminals.
In Troy, Michigan, digital forensics firm N1 Discovery plays that role.
Related: Ascension outage causes EHR, MyChart downtime, delays surgeries
Their teams are often only a degree removed from the hackers themselves. The cat to their mouse. Forensics for the digital age. They make first contact, negotiate, ask for the cyber version of a proof of life and seek a remedy — sometimes ransom payments, sometimes not.
It's an intensity that's likely happening at Ascension right now, as it continues to work with its contracted cybersecurity firm, Mandiant, to get its systems back online from a May 8 ransomware attack that impacted its 140 hospitals — including 15 in Michigan — and took its entire electronic medical record system offline.
Scott Wrobel, principal of N1 Discovery.
As a result, staff have turned to paper charts, emergency rooms are diverting patients and elective procedures are being cancelled. Ascension has notified law enforcement, including the FBI, but the system's response to the attack continues.
The ransomware dance is complex. Negotiators stall, working around the clock to determine how the hackers got in, what information they have and whether the entire debacle can be remedied from the inside. Meanwhile, the cybercriminals are impatiently waiting for their cryptocurrency ransom, hurling threats of what can be done with the stolen data.
Crain’s interviewed Scott Wrobel, principal of N1 Discovery, on the details of cyberattacks and the behind the scenes on what happens during a ransomware attack.
Our cybersecurity division has at least four to five ongoing cyber responses that we’re managing at any given time.
Easier payday. These are organizations that just have massive systems that have been around for a long time. They’ve been migrated and upgraded so many times, it becomes a business and financial challenge to keep everything secure. There is no way around it. It costs a lot of money to keep everything secure. It takes a lot of money for a company like Ascension to plug all the holes. I don’t know what vulnerabilities they had, but I do know their systems are complicated. Most healthcare companies have multiple systems that have been around and migrated and legacy systems that aren’t upgraded. Their IT staff are overwhelmed because there is just so much to do. Constantly upgrading is a logistical nightmare. If something is out of date, then you become worried by patching with a new update, it will break something else.
Typically, once the company is hit the ransom will come with a note. Often their data is encrypted by the threat actors and they can’t access it. The note identifies the threat actors and gives them a website on the dark web or an email to contact them. Sometimes it’s a Proton email account (a Swiss account that is encrypted that does not comply with government data requests). We make first contact, handling the negotiations and discussions with the threat actors while also assisting the company to get back online. We’re basically just asking them what they are looking for. They usually give a number of Bitcoins or an exact dollar amount. If the value is high, they’ll just give the number of Bitcoins they want. If it’s low, they’ll say they want $1 million in Bitcoins. While we’re negotiating, the company and my forensics team will try to understand how it happened and we try to preserve as much as we can so we don’t destroy evidence. It’s all part of the process; preservation, investigation, negotiation and remediation.
Not a Modern Healthcare subscriber? Sign up today.
They are betting on two things — that they’ve shut down the systems so badly the company would have to pay the ransom and that they have data they will post on the dark web that is valuable enough for the company to pay.
After they give the amount they want, they put us on a timer. Like, they may say we have seven days to pay or they will publish the company name on the dark web, telling others the company was hit and vulnerable. Sometimes it’s just the reputational hit is enough to sway the conversation. Then the counter starts and if the ransom isn’t paid, they will release the information on the dark web for purchase.
One of the tactics they use when they get into a system, besides the normal things you’ve heard, is look for and search for insurance policies. They’ll always research the companies. They know whether you can pay or not. A five person company? They are not going to say a $2 million ransom. A midsize or big company, a $500 million to a $1 billion company? They are going to raise the amount, especially if they found the insurance policy and how much is covered. Once they find it, they’ll show you they have it to prevent you from saying you can’t afford it.
That depends. These companies are usually working with their insurance company, a law firm and with state and federal laws. If the actors have PII (personal identifiable information) or PHI (personal health information), they have a responsibility to understand what data was taken and notify those individuals impacted and to state attorney general offices. They have to work very quickly to determine what was taken and whether they can get their systems back online without paying the ransom or whether they can rebuild the systems without major interference. On average, there is a good percentage of companies that will pay the ransom if they are unable to recover from backups and restore their business.
We have two objectives. To try and stall as much as possible to get some answers as to what happened. It’s probably less stalling but taking as much time as you can to get forensics done while maintaining conversation. Usually we get four to five days before they start to get irritated.
And you have to understand the threat actor groups. One group might not tell you anything about what they took. We need to know how chatty they will be and how willing they are to talk. We usually ask that they prove they can decrypt the data with a key. We ask for a few files that we can decrypt the files and send them that proof back. They are usually very business like. They tend not to be hostile unless they sense you’re playing games or stalling too much. Or if you’ve waited too long to make first contact. Their goal is to get paid.
Never miss an important news story again. Sign up for Modern Healthcare Alerts.
Unfortunately, there are so many groups. There are several large organizations that have affiliates underneath them. Basically using ransomware as a service makes it so anyone can be a threat actor by using another organization’s tools to do this. They are definitely mostly overseas. A lot of them are from Russia and Asian countries. But you don’t have to be in a certain country to be an affiliate, they can be anywhere.
In the past, there used to be some concept of honor among thieves. You for the ransom, get the encryption key and the name and data never show up again. But now there are all of these affiliate groups and things don’t always go as planned. There is simply no guarantee they won’t disrupt you again or use that data.
We simply provide the consulting on whether or not they’ll be able to recover or remediate their systems. The legal team and company has to make that decision. They have to weigh whether the insurance company will cover the ransom payments. A lot of insurers won’t cover the ransom unless you were truthful with them about your security policies. If you told them you have MFA (multi-factor authentication) on all of your servers and you don’t, the insurance company is not going to pay that ransom.
If they pay the ransom, what has to happen is we get the encryption key but we don’t jump right in. We have to test the keys to make sure the threat actor didn’t put a trojan horse or a virus on the key. We do it in what we call a sandbox (a file that’s disconnected from the entire system) and wait and see if anything bad happens. Then we have to decrypt the data, which takes so much longer than encrypting. If there is a large amount of data, to be decrypted safely may take a week or so before it’s up and running.
This is an industry that’s not going away. It changes daily and you can’t keep up. It’s a huge cost impact and will continue to be so.
Send us a letter
Have an opinion about this story? Click here to submit a Letter to the Editor, and we may publish it in print.
