Feds Warn Healthcare Sector of Rising Iranian Cyberthreats

U.S. federal authorities are warning of increased risk of Iranian cyber and related threats against healthcare and public health sector organizations – including ransomware, distributed denial-of-service and other attacks related to that nation’s escalated conflicts with Israel and the United States.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Because of rising geopolitical tensions, healthcare providers are encouraged “to prepare for the likelihood of increased cyberattacks against healthcare entities,” the U.S. Department of Health and Human Services’ Administration for Strategic Preparedness and Response warned in an advisory issued Tuesday.

Healthcare providers and other sector organizations are advised to review their vulnerability management strategy and contingency planning and adopt a heightened cyber-defense posture, said HHS ASPR’s Office of Cybersecurity and Infrastructure Protection.

“While there is no current evidence of specific targeting against healthcare and public health sector organizations, we know that the sector has historically been the victim of cyberattacks from a wide range of cyber threat actors during periods of conflict,” HHS ASPR said.

“Nation-state threat actors, sympathetic hacking groups, ransomware groups, and other cyberthreat actors seek to take advantage of known conflicts,” the advisory said.

“Iranian government-affiliated cyberthreat actors, in particular, have been known to utilize brute force methods, such as password spraying and multi-factor authentication ‘push bombing’, to compromise networks and obtain credentials,” authorities warn.

DDoS attacks, spear-phishing, exploiting publicly known vulnerabilities and leveraging multiple open-source tools are also common tactics that have been observed, HHS ASPR said.

The interconnected nature of the healthcare and public health sector infrastructure especially puts organizations at risk, HHS ASPR said.

“All owners and operators of HPH infrastructure, regardless of size, should review their vulnerability management strategy and contingency planning.”

Organizations should take crucial actions including access restrictions, implementation of intrusion detection systems, and regular backup of critical assets, HHS ASPR said.

Earlier Warnings

The HHS ASPR alert follows warnings issued in recent days from multiple other U.S. government agencies, including the FBI, Cybersecurity and Infrastructure Agency, and the Department of Defense Cyber Crime Center (see: Warnings Ratchet Up Over Iranian Cyberattacks).

The Department of Homeland Security on Sunday issued a National Terrorism Advisory System bulletin following the U.S. airstrikes on three Iranian nuclear facilities. That NTAS bulletin, which is effective through Sept. 22, also warns that both hacktivists and Iranian government-affiliated actors routinely target “poorly secured U.S. networks and internet-connected devices for disruptive cyberattacks.”

HHS ASPR said two previously released joint U.S. government agency alerts pertaining to Iranian cyberthreats, including one on brute force attacks and another on advanced persistent threat group MuddyWater, are still relevant to the current geopolitical climate (see: Feds Warn of Iranian Threats to Healthcare Sector).

DHS’ most recent alert also warns that cyber risk may escalate if Iran’s leadership issues religious decrees against U.S. targets.

“Iranian hacktivist groups may be operating more closely with state entities as Iran explores asymmetric responses to U.S. and Israeli actions,” said Phil Englert, vice president of medical device security at the Health Information Sharing and Analysis Center.

“This includes state-backed hacktivism, where pro-Iranian groups receive tools and resources from Iranian nation-state actors. Conversely, Iranian state-sponsored groups may pose as hacktivists to obscure attribution while targeting U.S. and Israeli critical infrastructure.”

Iran may support sympathetic hacktivist groups or create fake ones as fronts for state operations. One example is CyberAv3ngers, suspected of ties to Iran’s military, which attacked U.S. water treatment PLCs made by Israeli firm Unitronics in late 2023, he said.

APT35, a known Iranian threat actor, has conducted operations disguised as grassroots activism to complicate attribution, he said.

Previous Iranian-linked incidents in the U.S. healthcare sector include a thwarted cyberattack on Boston Children’s Hospital in 2021 (see: FBI: Hospital Averted ‘Despicable’ Iranian Cyberattack).

In the past few years, hacktivism has played a more central role in other regional conflicts, as well. When Russia invaded Ukraine, Health-ISAC observed a large number of hacktivist groups launch attacks at critical infrastructure organizations.

“Because the health sector is one of the core pillars of modern critical infrastructure, it is often targeted in politically motivated hacktivist campaigns aimed at attacking a nation,” said Denise Anderson, president of the Health-ISAC.

The current Iranian threats don’t just potentially affect healthcare and public sector entities directly in the U.S., but also their supply chains, as well as critical healthcare organizations outside the U.S., she said.

“When we’ve seen geopolitical tensions like this in the past, typical threats center around DDoS attacks and website defacements,” Anderson said.

“Given that many software security vendors operate out of Israel, disruptions to their services could also be a factor,” she said.

Taking Action

Health organizations with operations in the region need to take physical security measures and the sector should be vigilant for any anomalies in networks, website traffic and cyber operations, Anderson said.

The Health-ISAC strongly urges all healthcare organizations to adopt robust cybersecurity frameworks and remain on high alert.

Some steps include preparing for a potentially large influx of patients, especially in large cities, in case of a cyberattack or other disruptions, such as protests.

“Inform EMS personnel of possible demonstrations and advise them to prepare for sudden rerouting,” Englert said. “Proactively contact your DDoS mitigation service provider to ensure they know the heightened threat landscape. Confirm that your profiles are correctly configured. Maintain a backup site in case of a successful DDoS attack against your public-facing website.”