Redscan Case Studies Leveraging EDR to Combat Advanced Malware Threats in Healthcare

Edit This Case Study Record

	Leveraging EDR to Combat Advanced Malware Threats in Healthcare Redscan

Leveraging EDR to Combat Advanced Malware Threats in Healthcare

Redscan

Technology Category	Cybersecurity & Privacy - Intrusion Detection Cybersecurity & Privacy - Malware Protection
Applicable Industries	Healthcare & Hospitals National Security & Defense
Use Cases	Intrusion Detection Systems Tamper Detection
Services	Cybersecurity Services Training
Challenge	A private healthcare organisation in the UK, which processes large volumes of sensitive patient data, was targeted by a sophisticated type of malware. The malware aimed to harvest employee credentials and exfiltrate data. The organisation was already using Redscan’s Managed Endpoint Detection and Response service to protect its data beyond the level of security offered by traditional perimeter solutions. However, the malware attack posed a significant threat to the organisation's operations and the security of patient details. The challenge was to quickly identify, investigate, and respond to the attack to minimise operational disruption and prevent patient details from being stolen. Read More
About Customer	The customer is a private healthcare organisation based in the UK. The organisation processes large volumes of patient data, including highly sensitive medical records. The protection of this information is of utmost importance to the organisation, which is why it uses Redscan’s specialist managed detection and response service. This service provides the people, technology, and intelligence needed to swiftly identify and address a wide range of threats. The organisation was recently targeted by a sophisticated type of malware that sought to harvest employee credentials and exfiltrate data. Read More
Solution	Redscan’s Managed Endpoint Detection and Response service, which includes Proactive Intrusion Detection System (IDS) and Security Information and Event Management (SIEM) monitoring, was used to identify the attack. Carbon Black’s Response solution was deployed across a series of the organisation’s high-risk endpoints, enhancing event visibility, threat hunting, and incident response. The Redscan team was alerted to the presence of malware on two of the client’s host machines and quickly established that the alert was a true positive. The client was advised to isolate the infected hosts, perform a full malware scan, and block the observed malicious IPs at the perimeter firewall. When the same malware was detected on two additional hosts, the Redscan team used Cb Response to ban the signature of the identified malware binaries and isolate all infected hosts from the network. The team then analysed the kill chain of the attack and identified the malware as Trickbot, a Trojan designed to harvest user credentials, exfiltrate data, and add infected hosts to a botnet of devices. Read More Log in to view content
Contents

Technology Category

Cybersecurity & Privacy - Intrusion Detection

Cybersecurity & Privacy - Malware Protection

Applicable Industries

Healthcare & Hospitals

National Security & Defense

Use Cases

Intrusion Detection Systems

Tamper Detection

Services

Cybersecurity Services

Training

Challenge

A private healthcare organisation in the UK, which processes large volumes of sensitive patient data, was targeted by a sophisticated type of malware. The malware aimed to harvest employee credentials and exfiltrate data. The organisation was already using Redscan’s Managed Endpoint Detection and Response service to protect its data beyond the level of security offered by traditional perimeter solutions. However, the malware attack posed a significant threat to the organisation's operations and the security of patient details. The challenge was to quickly identify, investigate, and respond to the attack to minimise operational disruption and prevent patient details from being stolen.

About Customer

The customer is a private healthcare organisation based in the UK. The organisation processes large volumes of patient data, including highly sensitive medical records. The protection of this information is of utmost importance to the organisation, which is why it uses Redscan’s specialist managed detection and response service. This service provides the people, technology, and intelligence needed to swiftly identify and address a wide range of threats. The organisation was recently targeted by a sophisticated type of malware that sought to harvest employee credentials and exfiltrate data.

Solution

Redscan’s Managed Endpoint Detection and Response service, which includes Proactive Intrusion Detection System (IDS) and Security Information and Event Management (SIEM) monitoring, was used to identify the attack. Carbon Black’s Response solution was deployed across a series of the organisation’s high-risk endpoints, enhancing event visibility, threat hunting, and incident response. The Redscan team was alerted to the presence of malware on two of the client’s host machines and quickly established that the alert was a true positive. The client was advised to isolate the infected hosts, perform a full malware scan, and block the observed malicious IPs at the perimeter firewall. When the same malware was detected on two additional hosts, the Redscan team used Cb Response to ban the signature of the identified malware binaries and isolate all infected hosts from the network. The team then analysed the kill chain of the attack and identified the malware as Trickbot, a Trojan designed to harvest user credentials, exfiltrate data, and add infected hosts to a botnet of devices.

Impact #1	The incident response capabilities of Redscan’s Managed Endpoint Detection and Response service proved crucial in quickly identifying and responding to the malware attack. The service's Proactive Intrusion Detection System (IDS) and Security Information and Event Management (SIEM) monitoring helped identify the attack, while Carbon Black’s Response solution enhanced event visibility, threat hunting, and incident response. The Redscan team was able to quickly isolate all infected hosts from the network, preventing additional infections. The team also conducted a detailed digital forensics investigation to understand the kill chain of the attack. Following the incident, the Redscan team prepared a detailed report for the client, including a full event timeline and a list of recommendations to help mitigate the risk of future attacks.

Impact #1

The incident response capabilities of Redscan’s Managed Endpoint Detection and Response service proved crucial in quickly identifying and responding to the malware attack. The service's Proactive Intrusion Detection System (IDS) and Security Information and Event Management (SIEM) monitoring helped identify the attack, while Carbon Black’s Response solution enhanced event visibility, threat hunting, and incident response. The Redscan team was able to quickly isolate all infected hosts from the network, preventing additional infections. The team also conducted a detailed digital forensics investigation to understand the kill chain of the attack. Following the incident, the Redscan team prepared a detailed report for the client, including a full event timeline and a list of recommendations to help mitigate the risk of future attacks.

Benefit #1	Quick identification and response to the malware attack, minimizing operational disruption
Benefit #2	Successful isolation and cleaning of all infected machines
Benefit #3	No evidence of data loss despite the malware's attempt to conduct an internal network IP scan

Benefit #1

Quick identification and response to the malware attack, minimizing operational disruption

Benefit #2

Successful isolation and cleaning of all infected machines

Benefit #3

No evidence of data loss despite the malware's attempt to conduct an internal network IP scan

Download PDF Version

Overview

Leveraging EDR to Combat Advanced Malware Threats in Healthcare

Operational Impact

Quantitative Benefit