You're listening to the CyberWire Network, powered by N2K.

This is a SISA Cybersecurity Alert.

ID number Alpha Alpha 2-TAC 187 Alpha.

Original release Treasury are releasing this joint cybersecurity advisory to provide information on Maui

Ransomware which has been used by North Korean state-sponsored cyber actors since at

least May 2021 to target health care and public health sector organizations.

Since May 2021, the FBI has observed and responded to multiple Maui ransomware incidents

at health care and public health sector organizations. North Korean state-sponsored cyber actors used Maui ransomware in these incidents to encrypt servers

responsible for health care services, including electronic health records services,

diagnostics services, imaging services, and internet services.

The initial access vectors for these incidents is unknown.

According to industry analysis of a sample of Maui malware, the ransomware appears to be designed for manual execution by a remote actor.

The remote actor uses the command line interface to interact with the malware and to identify target files.

The alert documentation linked in the show notes includes tactics, techniques, and procedures

and indicators of compromise for this malicious activity.

The FBI, CISA, and Treasury urge health care and public health sector

organizations as well as other critical infrastructure organizations to apply the recommendations

in the mitigation section of this alert to reduce the likelihood of compromise from ransomware operations.

The FBI, SISA, and Treasury highly discouraged paying these ransoms.

Doing so does not guarantee files will be recovered and may pose sanctions violations and risks.

In September 2021, Treasury issued an updated advisory highlighting the sanctions risks associated with

ransomware payments and the proactive steps companies can take to mitigate such

...