Warning of Daxin Team Ransomware Group Targeting the Healthcare and Public Health Sector via VPNs
This new group makes the case that – as with any market – cybercriminals will focus on a niche sector they are experts on in order to improve their chances of success.
Haven’t heard of Daxin Team? That’s probably because they’re doing what most new businesses do in a saturated market: focus on a subset of that market. In Daxin Team’s case, it’s a two-pronged definition, according to a recent alert:
- They are targeting the Healthcare Sector
- They are focused on gaining initial access to victims through unpatched vulnerabilities in virtual private network (VPN) servers
The targeting of the Healthcare sector isn’t the interesting part; the initial access is. Historically, RDP compromise and phishing-based attacks have been flip-flopping 1st position as the most-used initial attack vector since 2018, according to ransomware response vendor Coveware. What’s fascinating is that the Coveware data shows a steady incline in the use of software vulnerabilities – something that includes vulnerabilities on VPN servers. The Daxin Team gang is a great practical example of that – and why organizations need to ensure every system that is externally accessible in any way possible is kept completely up to date.
But with phishing still the dominant leader in initial attack vectors, it’s equally necessary to make certain users aren’t engaging with potentially malicious content in email and on the web – something taught using continual Security Awareness Training.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 23 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW