Full Report
Hackers cloned a legitimate medical image viewer site to distribute malware, but thanks to Huntress, the threat was detected in time. Dive into the incident and see how we uncovered the deception and averted disaster.
Analysis Summary
# Incident Report: Phishing via Cloned Medical Software Site
## Executive Summary
In July 2024, attackers leveraged a CISA security advisory to distribute a malicious version of the MicroDicom medical image viewer. By cloning the legitimate software website and utilizing typosquatting, the threat actors induced healthcare organizations to download a "patched" installer containing an unauthorized SSH tunneling backdoor. The incident was detected and mitigated by Huntress SOC before the established tunnels could be fully exploited for lateral movement or data exfiltration.
## Incident Details
- **Discovery Date:** July 16, 2024
- **Incident Date:** July 1, 2024 (Domain registration) – July 16, 2024 (Detection)
- **Affected Organization:** Two medical organizations (specific names undisclosed)
- **Sector:** Healthcare
- **Geography:** Undisclosed
## Timeline of Events
### Initial Access
- **Date/Time:** July 2024 (following a June 11 CISA advisory)
- **Vector:** Phishing/Social Engineering and Typosquatting.
- **Details:** Attackers registered `mlcrodlcom[.]info` (cloning the legitimate `microdicom[.]com`) and likely sent phishing emails urging users to download a security patch to address a recent CVE.
### Lateral Movement
- **Details:** No successful lateral movement was reported. The attack was interrupted during the initial "Command and Control" establishment phase via SSH tunneling.
### Data Exfiltration/Impact
- **Details:** No patient data was reported stolen; however, the presence of an SSH tunnel on a DICOM viewer (which handles PHI) posed a severe risk of unauthorized access to sensitive medical records.
### Detection & Response
- **Discovery:** Huntress SOC identified suspicious SSH connections originating from the MicroDicom installer to a direct IP address rather than a domain.
- **Response:** Analysts isolated the affected endpoints, conducted a comparative analysis of the legitimate (13MB) vs. malicious (178MB) installers, and verified the typosquatted domain.
## Attack Methodology
- **Initial Access:** Typosquatting and Phishing (Fake software updates).
- **Persistence:** Malicious "updater" bundled with the installer that executes on startup.
- **Defense Evasion:** Using a legitimate-looking installer and cloning a trusted website; utilizing a common utility (SSH) for tunneling to blend with network traffic.
- **Command and Control:** SSH tunneling to a hardcoded attacker-controlled IP using shared private keys across different victims.
- **Impact:** Potential for unauthorized remote access and data breach of Protected Health Information (PHI).
## Impact Assessment
- **Financial:** Minimal (Preventative detection saved remediation costs).
- **Data Breach:** None confirmed, but high potential risk to PHI.
- **Operational:** Minimal (Short-term isolation of two endpoints).
- **Reputational:** Potential impact on the legitimate software provider due to brand impersonation.
## Indicators of Compromise
- **Network:**
- `mlcrodlcom[.]info` (Defanged: mlcrodlcom[dot]info)
- Direct SSH connections to non-standard external IPs from application installers.
- **File:**
- Malicious MicroDicom Installer (Approx. 178MB)
- Legitimate MicroDicom Installer (Approx. 13MB)
- **Behavioral:**
- Medical imaging software initiating SSH tunnels using a shared private key across multiple distinct organizations.
## Response Actions
- **Containment:** Isolated infected hosts from the network immediately upon detection.
- **Eradication:** Removal of the malicious 178MB installer and the associated "updater" persistence mechanism.
- **Recovery:** Reinstallation of the legitimate software from the verified `microdicom[.]com` domain.
## Lessons Learned
- **Exploitation of Trust:** Attackers are actively monitoring CISA advisories not just to find vulnerabilities, but to weaponize the *fix* (patches/updates) as a social engineering lure.
- **File Size Discrepancy:** A significant difference in file size (13MB vs 178MB) is a high-fidelity indicator of a "wrapped" or "Trojanized" installer.
- **User Validation:** Users and even some IT admins may dismiss alerts if the application "looks" functional, emphasizing the need for SOC-level verification.
## Recommendations
- **Domain Whitelisting:** Implement web filtering to block newly registered domains (NRDs) and known typosquatting patterns.
- **Software Integrity:** Verify SHA-256 hashes of installers against the official vendor's documentation before deployment.
- **Education:** Train staff to verify the URL of a download source, specifically looking for subtle character swaps (e.g., 'l' for 'i').
- **Egress Filtering:** Restrict outbound SSH (Port 22) traffic from workstations to authorized servers only.