Jason G. Weiss Spoke to HealthcareInfoSecurity About LockBit 2.0 Threat Warning

According to HealthcareInfoSecurity, federal authorities are again warning health care and public health sector entities about potential threats posed by the ransomware-as-a-service (RaaS) group LockBit 2.0. Privacy, cybersecurity and data strategy counsel Jason G. Weiss addressed the potential threat.

“If you run your enterprise as a RaaS operation, then it is far more likely than not you will see a LockBit attack against a health care entity for sure,” said Weiss. “It is hard to imagine the LockBit 2.0 gang telling the cyberthreat actors who pay for their tools who they can and can’t use these tools against. It is, of course, possible that this has already happened,” he added.

LockBit 2.0 poses a serious potential threat to the health care and public health sector in part because “it has been very successful as both a standalone cyber gang and now as an entrepreneur in the RaaS industry,” Weiss noted.

“They make a product that works and that has been successfully used against many targets in many different industries,” Weiss commented. “Also, they have also been able to avoid American and international law enforcement, so they obviously have put some serious thought into operational security and anonymity.”

Weiss also stated that critical vulnerabilities, such as those in certain versions of Apache’s Log4j software library, provide cyberthreat actors such as LockBit — and many others — with new, easy means of entry into a victim’s IT or operation technology network in order to launch ransomware attacks or steal data for ransom.

“There is little doubt among most industry experts that these types of large-scale vulnerabilities, especially after SolarWinds, open the door for the threat of greater cyberattacks. Worst-case scenario: This sure didn’t help,” Weiss concluded.