There's a new hacking group out there setting its sights on the lucrative healthcare sector, says cyber-watcher Symantec, and it isn't choosing its victims at random.

A new report says that the Orangeworm cadre is taking aim at the medical sector in the U.S., Europe and Asia. The attackers are using the Kwampirs backdoor – technically installing Trojan.Kwampirs inside the computer networks of targeted organizations.

Orangeworm has also attacked related industries as part of a larger assault on supply chain. Known victims include healthcare providers, pharmaceutical concerns, IT solution providers for healthcare, and equipment manufacturers that serve the healthcare industry, “likely for the purpose of corporate espionage,” warned Semantic.

Orangeworm, first spotted in 2015, chooses its targets carefully and then takes time to plan out its attacks.

“According to Symantec telemetry,” says the company in its statement, “almost 40 percent of Orangeworm’s confirmed victim organizations operate within the healthcare industry.

The Kwampirs malware was spotted in software in X-ray and MR machines. The attackers have also shown interest in breaking into computers used to collect patient data, complete forms and get patient consent.

“We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare,” warns the company.

It has found secondary targets in manufacturing, IT, agriculture, and logistics, which may appear unrelated, but the watchdog noted that “we found them to have multiple links to healthcare, such as large manufacturers that produce medical imaging devices sold directly into healthcare firms, IT organizations that provide support services to medical clinics, and logistical organizations that deliver healthcare products.”

Once Orangeworm infiltrates a network, it loads in the Kwampirs Trojan horse, which can collect data in order to determine if it has found a “high-value target,” says Symantec.

The firm also noted that while Orangeworm has been around for a number of years, “we do not believe that the group bears any hallmarks of a state-sponsored actor. It is likely the work of an individual or a small group of individuals.”

This is hardly the only recent example of cyber-hacking in the healthcare sector.

In March at HIMSS, the lessons from the front lines of the WannaCry attack, which unleashed ransomware onto over 300,000 computers around the globe, were reviewed by Kristopher Kusche, vice president and chief information security officer at Albany Medical Center (AMC).

“Because of our position and because of the way we have elaborated our infrastructure not to keep up with sectors like banking, we have become targets, accidental targets,” he said, adding that, “there’s not one federal agency that will say that health care was in the attack vector on these things. We weren’t in the plan. These things wouldn’t have targeted us, which kind of makes it a little more difficult, because these things were random. Now, we have to protect against everything because we’re not the target, we’re not the target of this stuff. But where somebody finds a hole, they take advantage of it.”

Health IT Homepage