1、 2025 Health Sector Cyber Threat LandscapeTLP:WHITE This report may be shared without restriction.health-isac.org February 2025TLP:WHITE2025 Health Sector Cyber Threat LandscapeBhealth-isac.orgContentsIntroduction 1Annual Member Survey Insights 2Survey Background.2Survey Findings .3Key Insights 4Par

2、t I:Recent Attacks Against Healthcare 5Patient Extortion .5High-Impact Ransomware Attacks.6Physical Security.7Part II:The Current Threat Landscape 8Supply Chain Attacks.8Ivanti.8Cybercriminal Activity.9XZ Utils .9Brute Patel.9Significant Takedowns .9Operation Cronos.9Operation Endgame .10Operation M

3、orpheus.10Operation Magnus .10Most Active Ransomware Gangs Attacks.11LockBit 3.0 .11BianLian .11INC Ransomware.12Ransomhub.12QiLin Ransomware.12Nation-State Activity .13APT29 WINELOADER Campaign.13UTA0178 Exploitation of Ivanti Vulnerabilities .13North Korean Remote IT Workers .13Geopolitical Activi

4、ty.14Russia/Ukraine War Escalation.14Threats to EU Energy Infastructure .14Middle East Escalation.14Medical Device Security .14Health-ISAC Medical Device Vulnerability Research.14Medical Devices Connected to Unsecured Networks .15Exposed Imaging Servers.15Part III:Tactics,Techniques and Procedures 1

5、6Social Engineering.16Help Desk Targeting .16TOAD Campaigns .16Spam Bomb Social Engineering .16Most Shared Malware Observables by Family .17Top 5 Malware Families Share by the Health-ISAC Membership.17Agent Tesla .17Remcos RAT.17AsyncRAT .17DarkGate.18XWorm.18Breakdown of 2024 IOC Distribution .18No

6、table Vulnerabilities and Exposures.20RDP Exposures.20Ivanti Connect .20FortiOS.21MOVEit Transfer Authentication Bypass.21Check Point.21Part IV:Future Cybersecurity Outlook 22Business Resilience .22Ransomware Attacks on Blood Suppliers.22CrowdStrike Outage .22Emerging Cybercriminal Threats .23OpenAI