Covid-19 Reveals Ransomware’s Long Game

THE NOVEL CORONAVIRUS pandemic has stretched the world’s health care systems to their limits, creating a global crisis. New research from Microsoft shows that ransomware attackers are actively making that crisis worse, forcing health care and critical infrastructure organisations to pay up when they can least afford downtime. In many cases, hackers are reaping the rewards of groundwork they laid months ago, before Covid-19 fully hit.

Hackers have known for years that hospitals and other health care providers make perfect targets for ransomware attacks, since there’s life-or-death urgency in getting back up and running quickly. During the pandemic, though, the risk has become even more dire. After a hospital in the Czech Republic was hit by a debilitating ransomware attack in March, the country’s cybersecurity oversight agency warned two weeks ago that it was bracing for widespread cyberattacks against critical services in the country. Two Czech hospitals reported attempted attacks a day later, and the US State Department threatened consequences if the antagonism continued.

The Czech incidents reflect just one corner of a worrying global trend of opportunistic ransomware activations.

“The attackers are definitely being what I’ll call rational economic actors, which unfortunately also means vicious,” says Rob Lefferts, corporate vice president of Microsoft 365 security. “We see behaviour where they will break into organisations and actually lie dormant, both because they’re doing reconnaissance but also because they are apparently estimating what is the moment in time when that organisation will be most vulnerable and most likely to pay.”

An initial attack might give hackers access to a victim’s network. But they’ll then wait weeks or months for a particularly opportune moment to actually infect the system with ransomware. Microsoft has been tracking such behaviour from groups using a number of prominent strains of ransomware, like Robbinhood, Maze, and REvil. While some ransomware groups had pledged not to attack hospitals during…