Health-ISAC 2026 Report Highlights Ransomware and Supply Chain Risks in Healthcare
Report discovered via Awesome Annual Security Reports.
Summary
Health-ISAC tracked 455 health-sector ransomware events in 2025. Its annual report highlights growing third-party risks, social engineering, legacy medical-device exposure, and AI-enabled attacks as respondents' leading concern for 2026.
Key points
- Health-ISAC surveyed nearly 250 health-sector executives and cybersecurity professionals in November 2025; respondents ranked AI-enabled attacks as their leading cybersecurity concern for 2026.
- The report tracked 455 ransomware events across the health sector in 2025, with Qilin accounting for 77 victims and INC Ransom for 50.
- Third-party compromises amplified exposure: the Episource breach affected more than 5.4 million individuals, while Cl0p exploited Cleo managed file transfer software in a mass extortion campaign.
- ClickFix, FileFix, and QR-code phishing exploited user trust to facilitate malicious command execution, credential theft, and malware delivery.
- Nineteen of Health-ISAC's 45 medical-device advisories in 2025 addressed DICOM/PACS vulnerabilities; legacy devices also required segmentation, monitoring, and replacement planning.
- Health-ISAC distributed more than 1,200 targeted alerts in 2025, including 407 concerning dangling DNS records and 98 concerning potentially vulnerable Citrix infrastructure.
- In a separate October 2025 survey about the CrowdStrike outage, approximately 69% of respondents reported being affected and 73% said they had reassessed their business resilience strategy.
Article Details
- Publisher
- Health-ISAC
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global health sector cyber threats, medical device security, physical security, and operational resilience.
- Sample Size
- Nearly 250 executives and cybersecurity professionals participated in the November 2025 member survey. The October 2025 CrowdStrike impact survey sample size was not disclosed.
- Key Statistics
- Health-ISAC tracked 455 ransomware events across the health sector during 2025.
- Health-ISAC attributed 77 health sector victims to Qilin in 2025, compared with 23 in 2024.
- Hospitals and Health Care accounted for 49.6% of the report's 2025 health sector ransomware victimology.
- Of 45 medical device advisories issued by Health-ISAC in 2025, 19 addressed DICOM/PACS vulnerabilities.
- Health-ISAC distributed more than 1,200 Targeted Alerts to member and non-member health sector organizations in 2025.
- Recommendations
- Identify medical devices using unsupported operating systems, establish replacement or upgrade plans, and apply compensating network segmentation and monitoring controls.
- Prioritize phishing awareness training, email and web filtering, and endpoint detection to counter ClickFix and FileFix.
- Educate staff about unknown QR codes, implement mobile device management, and analyze QR code content before access.
- Update affected NetScaler ADC and NetScaler Gateway appliances to the versions recommended by Citrix.
- Use the SMART Toolkit to identify and measure systemic risks from third-party technology, software, and communications services.
MITRE ATT&CK
T1059.001 · PowerShellPowerShell execution was among the five leading techniques observed by Health-ISAC members in 2025.T1078 · Valid AccountsSAFEPAY and Sinobi use stolen credentials to access target networks.T1189 · Drive-by CompromiseDrive-by compromise was among the leading member-observed techniques and is described as a common delivery method for SocGholish.T1190 · Exploit Public-Facing ApplicationSinobi exploits public-facing applications, while Cl0p exploited vulnerabilities in Cleo Managed File Transfer software to compromise organizations.T1204.004 · Malicious Copy and PasteMalicious copy-and-paste execution was among the leading member-observed techniques; ClickFix tricks users into copying and executing malicious commands.T1219 · Remote Access ToolsRemote Access Tools was listed among the five leading techniques observed by members in 2025.T1486 · Data Encrypted for ImpactThe report describes ransomware encrypting critical electronic health records and disrupting patient care.T1566.002 · Spearphishing LinkSpearphishing Link was listed among the five leading techniques observed by members in 2025.
CVE
CVE-2024-12356BeyondTrust (CVE-2024-12686, CVE-2024-12356)CVE-2024-12686BeyondTrust (CVE-2024-12686, CVE-2024-12356)CVE-2025-53770Microsoft SharePoint ToolShell (CVE-2025-53770)CVE-2025-7775Citrix NetScaler (CVE-2025-7775, CVE-2025-7776, andCVE-2025-7776Citrix NetScaler (CVE-2025-7775, CVE-2025-7776, andCVE-2025-8424Citrix Netscaler ADC and Citrix Gateway (CVE-2025-7775, CVE-2025-7776, CVE-2025-8424)
Threat Actors
APT28Named as a group that leveraged ClickFix to deploy malware.Cl0pExploited Cleo Managed File Transfer vulnerabilities in late 2024 and early 2025 to compromise hundreds of organizations for mass extortion.Cyber Islamic ResistancePro-Iran hacktivist group reported to have attacked nine Israeli health organizations in July 2025.Hunters InternationalGroup that reportedly announced its shutdown over law enforcement concerns; WorldLeaks is suspected to be its rebrand, not a confirmed continuation.INC RansomRansomware-as-a-service operator attributed 50 health sector victims in 2025; uses vulnerability exploitation, supply chain compromise, and social engineering.Killnet CollectiveCollective described as including ServerKillers and as having targeted health sector organizations in previous years.Linen TyphoonOne of three groups Microsoft linked to the Chinese government and observed actively exploiting the SharePoint ToolShell vulnerability.MuddyWaterNamed as a group that leveraged ClickFix to deploy malware.QilinRussian-speaking ransomware-as-a-service group attributed 77 health sector victims by Health-ISAC in 2025.SafepayRansomware group using social engineering and stolen credentials. The report's chart and comparison show 23 health sector victims in 2025, while its profile narrative inconsistently states 21.ServerKillersHacktivist group that temporarily disrupted Israeli medical center websites in June 2025; described as part of the Killnet Collective.sinobiGroup first observed in summer 2025, attributed 21 health sector victims, and described as apparently operating a ransomware-as-a-service platform.Strom-2603Named by the report as one of three groups Microsoft linked to the Chinese government and observed actively exploiting SharePoint ToolShell.Violet TyphoonOne of three groups Microsoft linked to the Chinese government and observed actively exploiting the SharePoint ToolShell vulnerability.worldleaksData-theft extortion group attributed 18 health sector victims in 2025; suspected by the report to be a rebrand of Hunters International.
Malware
AsyncRATAsyncRAT stands for Asynchronous Remote Access Trojan and is a malware family that is used to targetLumma Stealermalware, including SMOKESABER, Lumma Stealer, and ransomware. These attacks have specifically targetedNetSupportRATNetSupportRAT is malware packaged to look like the legitimate remote management tool NetSupportnjRATnjRAT is used to remotely control target computers. Written in the .NET framework, the malware has beenSMOKESABERmalware, including SMOKESABER, Lumma Stealer, and ransomware. These attacks have specifically targetedSocGholishSocGholish is a malware loader that is primarily used for initial access by threat actors. It is usually servedStealCcommands via the File Explorer's address bar. This method has been used to deliver StealC malware, oftenXWormXWorm is a remote access trojan (RAT) that is designed to harvest information from target systems.
Vendors
BeyondTrustTwo vulnerabilities in the BeyondTrust Remote Support product were exploited in December 2024, resultingCiscoCisco ASA 5500-X Series .............................................................CitrixCitrix Netscaler ADC and Citrix Gateway ..................................CleoCleo Compromise Victim Bundling ..................................ContecContec CMS 8000 Patient Monitor ............................................CrowdStrikeCrowdStrike update in July 2024 —underscore the necessity for robust planning that goes beyond traditionalEpisourceData Breaches — Episource ...........................................................Fortracyber attacks on the global health sector. In 2023, Fortra, Health-ISAC, and Microsoft led an effortMicrosoftMicrosoft SharePoint ToolShell ..................................................
Products
BeyondTrust Remote SupportTwo vulnerabilities in the BeyondTrust Remote Support product were exploited in December 2024, resultingCisco ASA 5500-X SeriesCisco ASA 5500-X Series (Adaptive Security Appliance) (CVE-2025-53770)Cisco FTDCisco ASA and FTD devices are typically deployed at the network perimeter—the crucial boundary betweenCleo Managed File Transferin late 2024 and early 2025 exploited vulnerabilities in the Cleo Managed File Transfer (MFT) software. TheContec CMS8000Claroty’s Team82 attributed the presence of the hard-coded IP address in the Contec CMS8000 PatientEpsimed MN-120such as the Epsimed MN-120, can be remotely controlled by unauthorized users, risking patient data andMicrosoft SharePointMicrosoft SharePoint ToolShell ..................................................NetScaler ADCCitrix Netscaler ADC and Citrix Gateway ..................................NetScaler GatewayADC and NetScaler Gateway products: CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424.Windows 10Windows 10 reached end-of-life on October 14, 2025, many devices running the
Tools
Countries
ChinaCylera linked the IP address to Tsinghua University in Beijing, China.22 23IranIsrael-Iran War .................................................................................IsraelIsrael-Iran War .................................................................................North KoreaNorth Korea has waged a concerted nation-state run operation to secure remote IT jobs to generate revenueUnited StatesFrom a regulatory perspective in the United States, the Save Healthcare Workers Act (H.R. 3178/S.1600)