Healthcare Ransomware Leak-Site Listings Rose 70% to 327
Summary
ReliaQuest reports healthcare and social-assistance organizations listed on data-leak sites rose 70% to 327 this quarter. It recommends edge hardening, phishing-resistant MFA, behavior-based detection, and faster automated response.
Key points
- Healthcare and social-assistance organizations named on data-leak sites rose 70% to 327; the article says exposure spread across more operators. These listings are not independent confirmation of compromise.
- Exploit Public-Facing Application accounted for 39% of observed techniques, and credential exposure became the sector's leading digital risk alert.
- The article reports 109 newly observed vulnerabilities in active exploitation, up 76%; 59 were weaponized within five days of disclosure, and same-day exploitation reached 32.
- Recommended steps include prioritizing patches for VPN and firewall flaws, restricting management interfaces, and placing exposed RDP behind a VPN with MFA. The article also highlights in-the-wild exploitation of CVE-2026-76504 and advises upgrading to a fixed release or restricting access and reviewing logs.
- The article reports that Storm-2755 used adversary-in-the-middle phishing to steal session tokens and hijack Microsoft 365 sessions; Microsoft Teams vishing callers reportedly persuaded staff to install persistent backdoors.
- Recommended defenses include prioritizing EHR systems, connected medical devices, privileged accounts, and patient portals; detecting misuse of remote-access and data-transfer tools such as AnyDesk and rclone; and enforcing phishing-resistant MFA.
- The article says mean time to contain improved 49% to 1 hour 5 minutes, while organizations using automated response playbooks averaged 8 minutes; it recommends immediate playbook action for validated malicious behavior.
Article Details
- Defense Focus
- Reduce ransomware risk to health care by hardening internet-facing systems, detecting shared attacker behaviors and identity abuse, and containing confirmed threats rapidly.
- Detection Methods
- Detect exploitation of public-facing applications and web-shell activity.
- Monitor for abuse of remote-access and data-transfer tools, including AnyDesk and rclone.
- Review administrator and API logs for unauthorized configuration changes.
- Monitor the open, deep, and dark web for exposed patient health information and credentials.
- Investigate reported phishing emails as soon as they arrive and monitor for credential abuse and ransomware tooling.
- Data Sources
- Administrator and API logs
- Identity, endpoint, network, cloud, and email telemetry
- Open, deep, and dark web sources for exposed PHI and credentials
- Defensive Actions
- Prioritize patching VPN and firewall flaws; upgrade Cisco Catalyst SD-WAN Manager to a fixed release for CVE-2026-76504.
- Until patched, restrict internet exposure of SD-WAN Manager, review administrator and API logs, and hunt for unauthorized configuration changes.
- Disable exposed RDP or place it behind a VPN with MFA, and restrict management-interface exposure.
- Prioritize protection for electronic health record systems, connected medical devices, privileged service accounts, and patient portals.
- Use application control and phishing-resistant MFA, including for payroll and clinical accounts.
- Automate phishing triage and use approved response playbooks to rapidly contain validated command-and-control, confirmed credential abuse, or ransomware tooling.
MITRE ATT&CK
T1078 · Valid AccountsThe article describes stolen identities and confirmed credential abuse as part of the reported access threat.T1190 · Exploit Public-Facing ApplicationThe article identifies exploitation of public-facing applications as a major access method, including exploitation of internet-facing flaws.T1219 · Remote Access ToolsThe article recommends detecting attacker abuse of remote-access tools such as AnyDesk.T1505.003 · Web ShellWeb Shell activity is reported among the observed techniques affecting the sector.T1528 · Steal Application Access TokenStorm-2755 reportedly stole session tokens and hijacked Microsoft 365 sessions.T1557 · Adversary-in-the-MiddleStorm-2755 reportedly used adversary-in-the-middle phishing to steal session tokens.T1566.004 · Spearphishing VoiceMicrosoft Teams vishing callers reportedly persuaded staff to install persistent backdoors.
CVE
Threat Actors
AnubisNamed among ransomware operators associated with health care sector exposure during the reporting period.Dire WolfNamed among ransomware operators associated with health care sector exposure during the reporting period.INC RansomNamed among ransomware operators associated with health care sector exposure during the reporting period.QilinNamed among ransomware operators associated with health care sector exposure during the reporting period.Storm-2755The article reports that Storm-2755 used adversary-in-the-middle phishing to steal session tokens and hijack Microsoft 365 sessions.The GentlemenNamed among ransomware operators associated with health care sector exposure during the reporting period.
Vendors
CiscoMFA, and restrict management-interface exposure. For CVE-2026-76504—a CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Manager, exploited in the wild—upgrade to a fixed release immediately, because compromiseIvantiand same-day exploitation nearly doubling to 32. Attackers moved quickly on internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch VPN and firewall flaws first, disable exposed RDP or putMicrosoftnearly doubling to 32. Attackers moved quickly on internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch VPN and firewall flaws first, disable exposed RDP or put it behind a VPN with MFA, and
Products
Cisco Catalyst SD-WAN Managerrestrict management-interface exposure. For CVE-2026-76504—a CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Manager, exploited in the wild—upgrade to a fixed release immediately, because compromise of SD-WANGreyMatterGreyMatter is built for that operating model. The platform decomposes investigations into single-task agents across identity, endpoint, network, cloud, and email, and routes each task through the AI Model Broker, whichIvanti Connect Securesame-day exploitation nearly doubling to 32. Attackers moved quickly on internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch VPN and firewall flaws first, disable exposed RDP or put it behindMicrosoft 365 Apps for Enterpriseidentity. “Storm-2755” used adversary-in-the-middle phishing to steal session tokens and hijack Microsoft 365 sessions, defeating non-phishing-resistant MFA, while Microsoft Teams vishing callers talked staffMicrosoft SharePointdoubling to 32. Attackers moved quickly on internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch VPN and firewall flaws first, disable exposed RDP or put it behind a VPN with MFA, andMicrosoft Teamssteal session tokens and hijack Microsoft 365 sessions, defeating non-phishing-resistant MFA, while Microsoft Teams vishing callers talked staff into installing persistent backdoors. Monitor the open, deep, and dark
Tools
AnyDesktechniques these operators have in common, such as abuse of remote-access and data-transfer tools like AnyDesk and rclone. Pair those detections with application control and phishing-resistant MFA to prevent theRClonethese operators have in common, such as abuse of remote-access and data-transfer tools like AnyDesk and rclone. Pair those detections with application control and phishing-resistant MFA to prevent the access and