U.S. disrupts North Korean hackers that targeted hospitals

NEW YORK -

The FBI and Justice Department recently disrupted the activities of a hacking group that was sponsored by the North Korean government and that targeted U.S. hospitals with ransomware, ultimately recovering half a million dollars in ransom payments and cryptocurrency, Deputy Attorney General Lisa Monaco said Tuesday.

Monaco revealed new details of the attacks during a speech in which she encouraged organizations hit by ransomware to report the crime to law enforcement, both so that officials can investigate and so that they can help victim companies try to get ransom payments back.

In this case, Monaco said, a Kansas hospital that paid a ransom last year after being attacked by ransomware also contacted the FBI, which traced the payment and identified China-based money launderers who assisted the North Korean hackers in cashing out the illicit proceeds. The FBI was able to recover half a million dollars, including the entire ransom payment from the hospital.

"If you report that attack, if you report the ransom demand and payment, if you work with the FBI, we can take action," Monaco said at the International Conference on Cyber Security, hosted by Fordham University. "We can follow the money and get it back; we can help prevent the next attack, the next victim; and we can hold cybercriminals accountable."

U.S. officials in 2021 scrambled to confront a wave of high-profile ransomware attacks -- in which hackers encrypt or lock up a victim's data and demand exorbitant sums to return it -- including against a crucial fuel pipeline on the East Coast. Though the pace of such large-scale, front-page attacks seems to have slowed, smaller targets -- such as hospitals -- continue to be affected.

FBI Director Christopher Wray said at the same conference that a particular challenge is that ransomware, once largely the province of garden-variety cyber criminals looking to extort cash, is now being increasingly deployed by hostile governments who are eager for destruction.

"The other thing we're seeing more and more of is ransomware actors doing more than just locking up the system," Wray said. "They're exfiltrating the information, they're threatening to release your proprietary information."

This particular variant of ransomware, known as "Maui," specifically targeted hospitals and public health organizations around the country.

Justice Department officials say the attack on the Kansas hospital, which they did not identify, took place in May 2021 when hackers encrypted the medical center's files and servers. The hospital paid about $100,000 in Bitcoin to get its data back.

The department said that in addition to recovering the payment from the Kansas hospital, it also got back a payment from a health care provider in Colorado that was affected by the same Maui ransomware variant.