Leveraging EDR to Combat Advanced Malware Threats in Healthcare

The customer is a private healthcare organisation based in the UK. The organisation processes large volumes of patient data, including highly sensitive medical records. The protection of this information is of utmost importance to the organisation, which is why it uses Redscan’s specialist managed detection and response service. This service provides the people, technology, and intelligence needed to swiftly identify and address a wide range of threats. The organisation was recently targeted by a sophisticated type of malware that sought to harvest employee credentials and exfiltrate data.

A private healthcare organisation in the UK, which processes large volumes of sensitive patient data, was targeted by a sophisticated type of malware. The malware aimed to harvest employee credentials and exfiltrate data. The organisation was already using Redscan’s Managed Endpoint Detection and Response service to protect its data beyond the level of security offered by traditional perimeter solutions. However, the malware attack posed a significant threat to the organisation's operations and the security of patient details. The challenge was to quickly identify, investigate, and respond to the attack to minimise operational disruption and prevent patient details from being stolen.

Redscan’s Managed Endpoint Detection and Response service, which includes Proactive Intrusion Detection System (IDS) and Security Information and Event Management (SIEM) monitoring, was used to identify the attack. Carbon Black’s Response solution was deployed across a series of the organisation’s high-risk endpoints, enhancing event visibility, threat hunting, and incident response. The Redscan team was alerted to the presence of malware on two of the client’s host machines and quickly established that the alert was a true positive. The client was advised to isolate the infected hosts, perform a full malware scan, and block the observed malicious IPs at the perimeter firewall. When the same malware was detected on two additional hosts, the Redscan team used Cb Response to ban the signature of the identified malware binaries and isolate all infected hosts from the network. The team then analysed the kill chain of the attack and identified the malware as Trickbot, a Trojan designed to harvest user credentials, exfiltrate data, and add infected hosts to a botnet of devices.

• The incident response capabilities of Redscan’s Managed Endpoint Detection and Response service proved crucial in quickly identifying and responding to the malware attack. The service's Proactive Intrusion Detection System (IDS) and Security Information and Event Management (SIEM) monitoring helped identify the attack, while Carbon Black’s Response solution enhanced event visibility, threat hunting, and incident response. The Redscan team was able to quickly isolate all infected hosts from the network, preventing additional infections. The team also conducted a detailed digital forensics investigation to understand the kill chain of the attack. Following the incident, the Redscan team prepared a detailed report for the client, including a full event timeline and a list of recommendations to help mitigate the risk of future attacks.

• Quick identification and response to the malware attack, minimizing operational disruption

• Successful isolation and cleaning of all infected machines

• No evidence of data loss despite the malware's attempt to conduct an internal network IP scan