Agencies issue Warzone RAT malware alert, critical infrastructure cyber guidance

The FBI Feb. 15 released an alert to help organizations detect and reduce the risk of network compromise from the Warzone Remote Access Trojan, a malware service used by over 7,000 cybercriminals and nation-state actors.

In other news, the Cybersecurity & Infrastructure Security Agency and other agencies recently released joint advisories to help organizations defend against Volt Typhoon and other cyber threat groups using living-off-the-land techniques to compromise and access U.S. critical infrastructure.

“Cyber threats related to nation-state adversaries are increasing at a very concerning rate, as evidenced in these alerts and in recent public statements by FBI, CISA and NSA leaders,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “These threats are often fueled by global botnets such as Warzone that exploit remote access to steal passwords and conduct network reconnaissance, selling the information to a rogues gallery of cyber adversaries. Enforcement operations such as the FBI’s recent disruption of the Warzone botnet is significant and commendable, but must continue at a steady pace for lasting effect. The increased cyber threats posed by Russia and China in particular pose a serious threat to the physical safety of U.S. critical infrastructure and may directly or indirectly impact hospitals. To help mitigate the risk of these threats, the health care field is reminded to prioritize patching for internet-facing systems; deploy phishing-resistant multi-factor authentication; and ensure logging is turned on for application, access, and security logs and store logs in a central system.”

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.