From a Hospital into the Realm of Hades
summary
Catalonia-CERT traces initial access via Citrix and links it to an initial access broker selling credentials and likely to a ransomware operator, an incident that escalates to ~60% of regional infrastructure and exposes ~122K users and up to 50K workstations. Poor segmentation at a large provider and exposed domain controllers enable lateral movement across hospitals and primary care, 80+ stakeholders slow decisions, mistakes include incomplete eviction and delayed eradication that alert the attacker, and containment runs for three weeks with restrictions, reduced trust relationships and improved detection.
AI-written summary · about
chapters (12)
- 0:00Catalonia CERT introduction
- 4:39Actor access to hospital detected
- 6:46First hospital compromised via Citrix
- 9:12Lateral movement detected
- 10:56Stakeholder management challenges
- 13:03Additional victims discovered
- 14:48Containment and resilient strategies
- 16:54Eviction after new actor involvement
- 19:10Adapting incident response
- 21:38Key challenges and lessons
- 24:50Lessons and scaling needs
- 27:05Conclusion and Q&A
related talks
40mThe Attack Surface of the Healthcare Industry
40mPublic Health Cyber War Games: How Hackers are Exploiting Healthcare
36m Macabre stories of a hacker in the public health sector (Chile)
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
21mRansomware Attack: Lessons Learned
52mRansomware; The Real Pandemic
51mGetting Serious: Critical Disruptions/Thinking/Responses (& Rumors of War)
22mCyber...