Dental Clinics Under Attack: How a Sophisticated Cyber Threat Was Stopped Before It Became a Ransomware Disaster

Warning! Be aware that Dental Clinics are being targeted by a sophisticated attack type that appears highly plausible to the medical professional; a email comes in from someone who is coming from out of town who is needing significant work done and is sending you their CBCT scan files along with an embedded viewer. This file may scan cleanly but contains code designed to abuse the viewing software, in this case NNTViewer ,on the surgery room PC. It then created recurring tasks at the system level in order to setup persistence artifacts on the computer that could be later exploited to give the attacker control over the computer.

In our clients case our Sophos Managed Detection & Response service linked to the Firewall onsite detected the suspicious actions & network traffic to the command and control server early and was able to contain the threat within minutes but if not for this then this may have lead to a wide scale ransomware attack. privacy breach of their customer database or worse financial exploitation either by an invoice scam or by gaining access to the director's banking information.

How do we defeat this? Antivirus alone is not enough, a firewall alone wont do it, spam filtering may pass a legit looking email straight through but having a combination of these in concert with active monitoring of the overall IT environment AND can take action 24x7x365 is immensely valuable protection greater than the sum of it's parts.