Anubis Ransomware: Santiam Hospital & Clinics Data Breach

The Anubis ransomware group has publicly claimed responsibility for a data breach at Santiam Hospital & Clinics. The group operates under a Ransomware-as-a-Service (RaaS) model and is known for double extortion, which involves exfiltrating sensitive medical data and encrypting organizational systems. The threat actor also provides affiliates with an optional destructive "wipe mode" to permanently delete data.

Impact

The breach at Santiam Hospital & Clinics has resulted in the exposure of sensitive medical data. Anubis has listed the victim on its public-facing onion leak site, indicating intent to extort the organization.

Recommendation

• Block the listed IP addresses at the perimeter firewall and web proxy to prevent communication with known Anubis infrastructure.
• Implement file integrity monitoring (FIM) and hunt for the presence of the provided MD5 hashes on endpoints to identify potential remnants of the Anubis ransomware payload.
• Prioritize monitoring of network traffic to and from healthcare infrastructure for unauthorized data staging or transfer, consistent with the double-extortion TTPs used by this group.