Antivirus in monitor mode, and eight weeks inside the national health network
Not yet reviewed
This one was written here from the source and has not yet been signed off, so it carries no byline. Every factual claim in it comes from the document linked below and can be checked against it. The judgements are ours, and until somebody has been back through them they are marked as unverified rather than presented as settled.
On 18 March 2021 a workstation at Ireland's Health Service Executive was infected when its user opened a malicious Excel file attached to a phishing email sent on 16 March. The attacker operated in the environment over an eight week period, compromising highly privileged accounts, servers, and six voluntary hospitals and one statutory hospital, before executing Conti ransomware at about 01:00 on 14 May 2021. The HSE switched off all its IT systems and disconnected the National Healthcare Network from the internet, and recovery efforts continued for over four months.
What worked
The Department of Health acted on an alert from its security provider on 13 May, contacted the NCSC and had endpoint detection and response tooling installed, which blocked the ransomware across the vast majority of its infrastructure. Hospital A brought in an incident response provider on 12 May, reset passwords for 4,500 accounts and changed firewall configuration. The HSE's shutdown on 14 May removed the attacker's access. PwC also lists as mitigating factors the relative simplicity of the attack and the attacker's release of a decryption key on 20 May.
What failed
On 31 March the HSE's antivirus detected Cobalt Strike and Mimikatz on the first infected workstation, but it was set to monitor mode and did not block them; that workstation had not had antivirus signatures updated for over a year. On 13 May the HSE's security provider emailed the Security Operations team about unhandled threat events since 7 May on at least 16 systems, and the team asked the Server team to restart servers. When Hospital A asked about two IP addresses, the HSE incorrectly concluded that the suspicious activity originated from Hospital A. Hospital C was advised that its risk was low because antivirus had remediated its Cobalt Strike alerts, and did not start an investigation. PwC found there was no security monitoring capability able to effectively detect, investigate and respond to alerts across the HSE's IT environment.
The number
8 weeks
the attacker operated inside the environment, through several detections, before the ransomware was executed.
What to do instead
Run endpoint protection in blocking mode, keep signatures current, and make a named team answerable for every unhandled detection within a fixed time. A Cobalt Strike or Mimikatz detection is an incident by definition, even when the antivirus reports it cleaned; restarting the server is not a response. When a connected organisation reports suspicious traffic from your addresses, examine your own hosts first. Build a monitored security operations capability with authority across the whole network, take offline backups on a fixed schedule, and keep a prioritised list of clinical systems ready for recovery.