meta_pixel
Tapesearch Logo
Log in
CyberWire Daily

CISA Alert AA22-294A – #StopRansomware: Daixin Team. [CISA Cybersecurity Alerts]

CyberWire Daily

N2K Networks, Inc.

Technology, Daily News, News, Tech News

4.81.1K Ratings

🗓️ 24 October 2022

⏱️ 3 minutes

🧾️ Download transcript

Summary

FBI, CISA, and Department of Health and Human Services are releasing this joint advisory to provide information on the Daixin Team, a cybercrime group that is actively targeting U.S. businesses, predominantly in the Healthcare and Public Health Sector. AA22-294A Alert, Technical Details, and Mitigations Stopransomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts. Resource to mitigate a ransomware attack: CISA-Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide. Ongoing Threat Alerts and Sector alerts are produced by the Health Sector Cybersecurity Coordination Center (HC3) and can be found at hhs.gov/HC3 For additional best practices for Healthcare cybersecurity issues see the HHS 405(d) Aligning Health Care Industry Security Approaches at 405d.hhs.gov  CISA offers several no-cost scanning and testing services to help organizations reduce their exposure to threats by taking a proactive approach to mitigating attack vectors. See www.cisa.gov/cyber-hygiene-services U.S. DIB sector organizations may consider signing up for the NSA Cybersecurity Collaboration Center’s DIB Cybersecurity Service Offerings, including Protective Domain Name System services, vulnerability scanning, and threat intelligence collaboration for eligible organizations. For more information on how to enroll in these services, email dib_defense@cyber.nsa.gov  To report incidents and anomalous activity or to request incident response resources or technical assistance related to these threats, contact CISA at report@cisa.gov, or call (888) 282-0870, or report incidents to your local FBI field office. Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript

Click on a timestamp to play from that location

0:00.0

You're listening to the CyberWire Network, powered by N2K.

0:07.0

This is a SISA Cybersecurity Alert.

0:14.0

ID number Alpha Alpha-22 TAC-294 Alpha.

0:20.0

Original release FBI and the Department of Health and Human Services are releasing this advisory to provide information on the Dexin team, a cybercrime group that is actively targeting U.S. businesses in the health care and public health sector.

0:41.0

The Dexin team is a Ransomware and Data Extortion Group that has public health and

0:43.0

and health-in team is a ransomware and data extortion group

0:45.0

that has targeted the health care sector

0:46.0

with ransomware and data extortion operations

0:48.0

since at least June 2022.

0:50.0

Since then,

0:52.0

decks-in team cybercrimeors have caused ransomware incidents at multiple health care

0:55.5

organizations.

0:57.5

Dexin Team employs ransomware to encrypt servers responsible for health care services,

1:02.1

including electronic health records services, diagnostic services, including electronic health records services, diagnostic services,

1:05.3

imaging services, and internet services, and has exfiltrated PII and

1:09.8

patient health information and threaten to release the information if a ransom is not paid.

1:15.8

Dixin actors gain initial access to victims through VPN servers.

1:20.0

In one confirmed compromise, the actors used compromised credentials to access a legacy

1:24.4

VPN server that did not use multi-factor authentication.

1:28.8

The actors are believed to have acquired the VPN credentials through a fishing email with a malicious attachment.

1:35.0

The alert documentation listed in the show notes includes Dexin team TTPs, indicators of compromise,

1:40.2

a mitre attack mapping for this threat activity and mitigations.

...

Please login to see the full transcript.

Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.

Copyright © Tapesearch 2026.