Colorado Medical Clinic · 2022-03
Andariel allegedly targeted a Colorado medical clinic as part of a North Korean Reconnaissance General Bureau-linked operation against U.S. healthcare organizations using Maui ransomware. The indictment described extortion of hospitals and health care providers, laundering of ransom payments, and reuse of the proceeds to lease servers for follow-on intrusions against defense, technology, government, manufacturing, and energy victims.
Maui ransomware: Colorado medical provider · April 2022
The FBI’s investigation confirmed that a medical provider in Colorado had just paid a ransom after being hacked by actors using the same Maui ransomware strain.
Ransomware ("aui.exe") attack on "Colorado Medical Clinic" · On or about March 24, 2022
On or about March 24, 2022, Conspirators gained unauthorized access to the Colorado Medical Clinic's computer system and deployed ransomware similar to Maui, with a file named "aui.exe," ... demanding a ransom of three Bitcoin. The ransomware encrypted the clinic's Electronic Health Record system and limited the services of the clinic for a week [Case No. 2:24-cr-20061, U.S. District Court for the District of Kansas; filing: INDICTMENT filed against Rim Jong Hyok as to counts 1, 2.]
Maui ransomware attack on a Colorado medical provider
This email address was linked to the Maui ransomware actors and an attack on a Colorado medical provider through cryptocurrency tracing, Binance records, and records from Proton Technologies AG. [Case No. 6:26-cv-01047, U.S. District Court for the District of Kansas; filing: COMPLAINT with trial location of Wichita, filed by United States of America.]
Maui ransomware attack on a Colorado medical provider; ransom traced to seized exchange account · on March 30, 2022
By tracing the April 1 payment into VCE Account B back to its source, the FBI's investigation revealed that another U.S.-based medical provider, this time located in Colorado, was hacked and its files were encrypted using the maui.exe software. Specifically, an incident response company confirmed to the FBI that, on March 30, 2022, the company made a payment of 2.54 BTC on behalf of the Colorado medical provider [Case No. 6:22-cv-01154, U.S. District Court for the District of Kansas; filing: COMPLAINT for forfeiture with Exhibit A declaration]
Maui ransomware: medical provider in Colorado · April 2022 (payment observed)
Annex 66: “In April 2022, the authorities observed a Bitcoin payment worth approximately USD 120,000 into one of the seized cryptocurrency accounts. ... Authorities confirmed that the funds were related to the payment of a medical provider in Colorado that was hit by the ‘Maui’ ransomware.” Footnote 138: the DOJ “seized around $500,000 that were ransom payments.”
dollar figures: a ransom of three Bitcoin (demanded)
The Conspirators left a note on the victim’s network demanding a ransom of three Bitcoin.