Page 13 - Threat Intelligence 10-3-2019

Web / Internet Threats

Three Alabama Hospitals Hit by Ryuk Ransomware; Ambulances Turned Away. A Ryuk ransomware attack
compromised three hospitals in Alabama’s DCH Health System on Oct. 1, forcing doctors to turn away non-
critical patients and obliging ambulances to seek other hospitals. The attack hit the DCH Regional Medical
Center, Northport Medical Center and Fayette Medical Center. A ransom request has yet to be received, but
the hospitals have some protocols in place for when the computer system is not available. “Although the
attack has impacted DCH’s ability to accept new patients, we are still able to provide critical medical services
to those who need it,” DCH representatives said. A few surgeries that couldn’t wait were performed, and the
hospitals advised patients to call before coming in.

Source: https://hotforsecurity.bitdefender.com/blog/three-alabama-hospitals-hit-by-ryuk-
ransomware-ambulances-turned-away-21562.html

New Fileless Botnet Novter Distributed by KovCoreG Malvertising Campaign. We found a new modular
fileless botnet malware, which we named “Novter,” (also reported and known as “Nodersok” and “Divergent”)
that the KovCoreG campaign has been distributing since March. We’ve been actively monitoring this threat
since its emergence and early development, and saw it being frequently updated. KovCoreG, active since
2011, is a long-running campaign known for using the Kovter botnet malware, which was distributed mainly
through malvertisements and exploit kits. Kovter has been involved in click fraud operations since 2015, using
fraudulent ads that have reportedly cost businesses more than US$29 million. The botnet was taken down at
the end of 2018 through concerted efforts by law enforcement and cybersecurity experts, including Trend
Micro.

Source: https://blog.trendmicro.com/trendlabs-security-intelligence/new-fileless-botnet-novter-
distributed-by-kovcoreg-malvertising-campaign/

Cyberattack causes $95 million loss for Demant. The Danish hearing aid manufacturer Demant has quickly
piled up a $95 million bill associated with a cyber incident that struck the company in early September. In a
September 26 financial statement, the company revealed how the cyber incident that began on September 3
has impacted the company’s financial situation. Demant executives credited the quick action taken by the
firm’s IT department in shutting down its network for containing the attack and limiting damage. Additionally,
the fact the data was backed up is enabling the company to recover.
Source: https://www.scmagazine.com/home/security-news/cyberattack-causes-95-million-loss-for-
demant/

www.accumepartners.com
13