CISA Alert AA22-294A – #StopRansomware: Daixin Team. [CISA Cybersecurity Alerts]
CyberWire Daily
N2K Networks, Inc.
4.8 • 1.1K Ratings
🗓️ 24 October 2022
⏱️ 3 minutes
🧾️ Download transcript
Summary
Transcript
Click on a timestamp to play from that location
| 0:00.0 | You're listening to the CyberWire Network, powered by N2K. |
| 0:07.0 | This is a SISA Cybersecurity Alert. |
| 0:14.0 | ID number Alpha Alpha-22 TAC-294 Alpha. |
| 0:20.0 | Original release FBI and the Department of Health and Human Services are releasing this advisory to provide information on the Dexin team, a cybercrime group that is actively targeting U.S. businesses in the health care and public health sector. |
| 0:41.0 | The Dexin team is a Ransomware and Data Extortion Group that has public health and |
| 0:43.0 | and health-in team is a ransomware and data extortion group |
| 0:45.0 | that has targeted the health care sector |
| 0:46.0 | with ransomware and data extortion operations |
| 0:48.0 | since at least June 2022. |
| 0:50.0 | Since then, |
| 0:52.0 | decks-in team cybercrimeors have caused ransomware incidents at multiple health care |
| 0:55.5 | organizations. |
| 0:57.5 | Dexin Team employs ransomware to encrypt servers responsible for health care services, |
| 1:02.1 | including electronic health records services, diagnostic services, including electronic health records services, diagnostic services, |
| 1:05.3 | imaging services, and internet services, and has exfiltrated PII and |
| 1:09.8 | patient health information and threaten to release the information if a ransom is not paid. |
| 1:15.8 | Dixin actors gain initial access to victims through VPN servers. |
| 1:20.0 | In one confirmed compromise, the actors used compromised credentials to access a legacy |
| 1:24.4 | VPN server that did not use multi-factor authentication. |
| 1:28.8 | The actors are believed to have acquired the VPN credentials through a fishing email with a malicious attachment. |
| 1:35.0 | The alert documentation listed in the show notes includes Dexin team TTPs, indicators of compromise, |
| 1:40.2 | a mitre attack mapping for this threat activity and mitigations. |
... |
Please login to see the full transcript.
Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.
Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.
Copyright © Tapesearch 2026.

