Arkansas Healthcare Company · 2022-03
An Arkansas healthcare company was part of the alleged Andariel-linked Maui ransomware and extortion conspiracy charged by the U.S. Justice Department against North Korean operator Rim Jong Hyok. Prosecutors said the DPRK Reconnaissance General Bureau-linked actors hacked and extorted hospitals and healthcare providers, laundered ransom payments through China-based facilitators, and reused proceeds to lease infrastructure for further intrusions.
Kansas Hospital · 2021-05
A Kansas hospital was among the U.S. healthcare targets in the alleged Andariel conspiracy charged by the U.S. Justice Department, which linked North Korean national Rim Jong Hyok and co-conspirators to Maui ransomware attacks against hospitals and health care providers. Prosecutors said ransom payments were laundered through China-based facilitators and used to lease infrastructure for follow-on intrusions against defense, technology, government, and energy targets.
Maui ransomware: Kansas medical center · May 2021
According to court documents, in May 2021, North Korean hackers used a ransomware strain called Maui to encrypt the files and servers of a medical center in the District of Kansas. After more than a week of being unable to access encrypted servers, the Kansas hospital paid approximately $100,000 in Bitcoin to regain the use of their computers and equipment.
Maui ransomware attack on "Kansas Hospital" · May 2021 (ransom paid on or about May 11, 2021)
"Kansas Hospital" is a hospital located in the District of Kansas, and a May 2021 ransomware victim. ... the ransom note left on the Kansas Hospital's computer network by Conspirator 1, demanding a ransom of two Bitcoin in exchange for restoring access to the encrypted computer servers [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]
Ransomware (similar to Maui, "m.exe") attack on "Arkansas Healthcare Company" · On or about March 7, 2022
On or about March 7, 2022, Conspirators gained unauthorized access to the Arkansas Healthcare Company's computer system and deployed ransomware similar to Maui, with a file named "m.exe," to deny the Arkansas Healthcare Company access to its computer system. The Conspirators left a note on the victim's network demanding a ransom. [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]
First known Maui ransomware attack, on a healthcare provider in Chanute, Kansas · on or around May 4, 2021 (payments May 11 and May 17, 2021)
officials working on behalf of a healthcare provider located in Chanute, Kansas, within the District of Kansas, advised the FBI that on or around May 4, 2021, the medical provider became the victim of a ransomware attack. ... The FBI confirmed that on May 11, 2021, a payment for 1.66 BTC was made on the Kansas healthcare provider's behalf to the bitcoin address supplied by the attackers. [Case No. 6:26-cv-01047, U.S. District Court for the District of Kansas; filing: COMPLAINT with trial location of Wichita, filed by United States of America.]
Maui ransomware attack on Kansas Medical Provider · on or around May 4, 2021 (payments May 11 and May 17, 2021)
The FBI's investigation confirmed that on May 11, 2021, a payment for 1.66 BTC was made on the Kansas Medical Provider's behalf to a BTC address controlled by the ransomware actor. The FBI also confirmed that on May 17, 2021, an additional payment for 0.11 BTC was made ... The FBI previously seized nearly $500,000 in cryptocurrency related to Maui ransomware victims from two Binance accounts. [Case No. 2:24-mj-08113, U.S. District Court for the District of Kansas; filing: APPLICATION FOR SEIZURE WARRANT as to User ID account 4690943.]
Maui ransomware attack on Kansas medical provider; ransom traced to seized exchange account · on or around May 4, 2021 (accounts seized on or about May 5, 2022)
Officials working on behalf of a medical provider located in the District of Kansas advised the FBI that on or around May 4, 2021, the provider became the victim of a ransomware attack. ... On July 6, 2022, the FBI, the Cybersecurity and Infrastructure Security Agency, and the Department of Treasury announced that the maui.exe ransomware was being used by North Korean state-sponsored cyber actors to target healthcare organizations. [Case No. 6:22-cv-01154, U.S. District Court for the District of Kansas; filing: COMPLAINT for forfeiture with Exhibit A declaration]
Maui ransomware: medical center in the District of Kansas · May 2021
Annex 66 (US Justice Department’s Disruption of DPRK’s ‘Maui’ Ransomware Campaign): “On 19 July 2022, US Justice Department announced the seizure of nearly half a million dollars in cryptocurrency that was paid as ransom to alleged DPRK cyberthreat actors and their accomplices by two US hospitals. In May 2021, threat actors infected the servers of the medical center in the District of Kansas. The Kansas hospital paid approximately USD 100,000 ransom in Bitcoin to regain the use of their computers and equipment.”
dollar figures: a ransom of two Bitcoin (demanded)
the ransom note left on the Kansas Hospital’s computer network by Conspirator 1, demanding a ransom of two Bitcoin in exchange for restoring access to the encrypted computer servers
dollar figures: two bitcoin — or roughly $118,000 at the time
Rim then allegedly demanded two bitcoin — or roughly $118,000 at the time — from the undisclosed Kansas hospital in May 2021. The hospital paid the hackers to regain access to the servers.