Latest / Tech Talks With Kinsoft / DragonForce Hits Australian Health Software Vendor HMS

Transcript

DragonForce Hits Australian Health Software Vendor HMS · Tech Talks With Kinsoft

• 0:00
  Welcome to Check Talks with Kinsoft. It is our
• 0:02
  absolute priority to take a massive stack of
• 0:05
  sources, you know, the latest articles, the raw
• 0:08
  incident reports, and really just extract the
• 0:10
  critical insights from them. Yeah, exactly. Our
• 0:13
  whole mission is to do that heavy analytical
• 0:15
  lifting for you. Right, just connecting the dots
• 0:17
  so that you can stay well -informed and, more
• 0:19
  importantly, secure in a digital landscape that
• 0:22
  is honestly just constantly shifting under your
• 0:24
  feet. It never stops moving, that's for sure.
• 0:26
  No, it really doesn't. And today... We are setting
• 0:29
  our sights on a singular, really high stakes
• 0:33
  event. We need to rewind the clock just slightly
• 0:36
  to around March 19th, 2026. Yeah, this was a
• 0:40
  major wake up call. It really was. So a notorious
• 0:42
  ransomware group known as Dragon Force stepped
• 0:45
  out of the shadows and they claimed a massive
• 0:47
  cyber attack on a company called Health Management
• 0:49
  Systems. Right. Operating at HMS .com .au. Exactly.
• 0:53
  And they are a major Australian provider of health
• 0:55
  care software. And, you know. The implications
• 0:58
  of that specific target are just monumental.
• 1:01
  Health management systems, I mean, they are not
• 1:02
  a hospital themselves, right? They are a software
• 1:04
  provider. Which changes everything. It does.
• 1:07
  We are currently watching the entire industry
• 1:09
  try to calculate the ripple effects of this compromise.
• 1:12
  And that is the core issue for you listening
• 1:14
  right now. This is not just, you know, a localized
• 1:16
  story about one unfortunate company dealing with
• 1:18
  a network intrusion. But far from it. Yeah, this
• 1:21
  is a blaring wake up call regarding the fragile
• 1:24
  nature of digital supply chains, specifically
• 1:26
  within the health care sector. When a single
• 1:29
  vendor experiences a breach. The blast radius
• 1:33
  extends way beyond their own internal IT department.
• 1:36
  Oh, absolutely. The downstream effects are terrifying.
• 1:38
  Right. It places countless downstream hospitals,
• 1:41
  local health clinics, and ultimately vulnerable
• 1:43
  patient data directly in the crosshairs. So to
• 1:47
  really understand the threat to your own organization's
• 1:50
  infrastructure, we first have to dissect exactly
• 1:53
  what happened to health management systems and,
• 1:55
  well, Look at the adversary pulling the strings.
• 1:58
  Yeah, because you cannot defend against an attack
• 2:01
  if you don't understand the mechanics of the
• 2:03
  weapon being used against you. The adversary's
• 2:06
  playbook tells us exactly where our structural
• 2:08
  vulnerabilities lie. Okay, let's unpack this.
• 2:12
  Dragonforce didn't just quietly lock up some
• 2:14
  servers and send a private email demanding cash,
• 2:17
  did they? No, not at all. They went completely
• 2:19
  public. Late last week, they listed health management
• 2:22
  systems directly on their leak site. Wow. Just
• 2:26
  openly claiming to hold highly sensitive data
• 2:29
  from this health care software provider. Yeah.
• 2:31
  And they issued a very direct threat. Negotiate
• 2:34
  a ransom or we release everything. And as of
• 2:37
  the initial reporting. We don't really have full
• 2:40
  confirmation from the company about the exact
• 2:42
  volume of data exfiltrated. Right. Or even the
• 2:44
  scale of the service disruptions. Right. The
• 2:46
  details are still coming together. But honestly,
• 2:48
  in this scenario, the threat alone is a ticking
• 2:50
  clock. It's terrifying. I mean, targeting the
• 2:53
  software vendor instead of a single clinic, it's
• 2:55
  like a thief stealing the master key from an
• 2:57
  apartment building's management office, rather
• 3:00
  than painstakingly trying to pick the locks of
• 3:02
  individual apartments one by one. That's a perfect
• 3:04
  way to look at it. And what's fascinating here
• 3:07
  is how this incident perfectly aligns with Dragon
• 3:10
  Force's established operational pattern. Right.
• 3:13
  They have a very specific M .O. They do. They
• 3:16
  are specialists and their chosen specialty is
• 3:19
  targeting the health care sector for what the
• 3:21
  cybersecurity community refers to as quick extortion.
• 3:25
  Quick extortion. I mean, that sounds highly predatory.
• 3:28
  Oh, it is. It's incredibly predatory. Break down
• 3:30
  the mechanics of that strategy for us. Why prioritize
• 3:33
  health care over, say, a massive financial institution
• 3:37
  or a global manufacturing plant? It really comes
• 3:40
  down to the unforgiving economics of the health
• 3:43
  care industry. I mean, think about it. If a manufacturing
• 3:45
  plant gets hit with ransomware and their assembly
• 3:48
  line halts, they lose revenue. It's bad, but...
• 3:52
  Yeah, it's a terrible situation. Shareholders
• 3:54
  are angry, but it's ultimately just a financial
• 3:56
  calculation. But if a hospital network goes offline.
• 4:00
  Medical staff lose the ability to access patient
• 4:03
  histories. Exactly. Surgical schedules, medication
• 4:06
  dosages. The urgency to recover in a health care
• 4:08
  setting is absolute. It involves human lives,
• 4:11
  patient safety. So Dragon Force intimately understands
• 4:15
  this high pressure environment. They bank on
• 4:18
  it. They know that hospital administrators or
• 4:21
  critical vendors like HMS will feel completely
• 4:23
  backed into a corner by the moral and operational
• 4:26
  imperative to restore services. And that drives
• 4:28
  them to pay ransoms quickly. Yes. Often bypassing
• 4:31
  prolonged negotiations entirely just to resolve
• 4:34
  the immediate crisis. Wow. And that strategy
• 4:37
  is amplified by the fact that they publicly posted
• 4:39
  HMS on their leak site. Yeah. I mean, they aren't
• 4:42
  just encrypting data and halting operations.
• 4:44
  They are threatening to expose it all. That is
• 4:46
  the double extortion model at work. The initial
• 4:49
  phase is locking the systems to halt operations,
• 4:52
  right? But the second phase is threatening to
• 4:54
  dump protected health information onto the dark
• 4:56
  web. Which introduces just severe regulatory
• 5:00
  terror. Precisely. In Australia, a massive data
• 5:04
  breach involving medical records triggers intense
• 5:06
  scrutiny, severe fines, and just irreparable
• 5:10
  reputational damage. Dragon Force is essentially
• 5:13
  turning the regulatory environment into a weapon
• 5:16
  against the victim. To maximize the leverage
• 5:18
  they have to force a payout. That is so cynical.
• 5:21
  It's brutal. And their strategy relies heavily
• 5:24
  on scale. They cannot extort the health care
• 5:26
  industry efficiently if they have to breach one
• 5:28
  heavily defended local clinic at a time. Right,
• 5:31
  which naturally drives them to exploit the digital
• 5:33
  supply chain. Yeah. Attacking the central nodes
• 5:36
  that connect to everyone else. Exactly. Here's
• 5:38
  where it gets really interesting. Let me throw
• 5:39
  a hypothetical at you. Okay, go for it. So if
• 5:41
  a local clinic out in the suburbs spends millions
• 5:44
  securing its own internal network. Right. They
• 5:47
  deploy top tier firewalls, endpoint detection
• 5:50
  and response, full zero trust network architecture.
• 5:53
  Are they still completely exposed simply because
• 5:56
  they use health management system software? If
• 5:58
  we connect this to the bigger picture, the uncomfortable
• 6:01
  reality is yes. Wait, really? Yeah. Even with
• 6:04
  all that internal security? Yes. They are structurally
• 6:08
  exposed. Look. 10 or 15 years ago, a hospital
• 6:11
  security perimeter was tangible. It was the physical
• 6:14
  building and the servers were sitting in a locked
• 6:17
  room on premises. Right. You just built a digital
• 6:19
  moat around that data center. Exactly. But today,
• 6:22
  that perimeter is entirely porous. The Perona
• 6:25
  extends to literally every piece of software
• 6:27
  that hospital purchases and integrates. I see.
• 6:30
  So when a clinic installs software from a vendor
• 6:33
  like HMS, they are granting that software and
• 6:36
  by extension, the vendor, a certain level of
• 6:39
  trusted access to their internal networks. Because
• 6:42
  it requires that access to actually function.
• 6:44
  Right. Whether that is pulling patient demographics
• 6:46
  or updating billing records. So they are essentially
• 6:49
  provisioning an open. trusted pathway straight
• 6:53
  through their own million -dollar firewall. Precisely.
• 6:55
  And hackers are highly opportunistic. Dragonforce
• 6:58
  realizes there is absolutely no need to spend
• 7:01
  months attempting to batter down the heavily
• 7:03
  guarded front door of a major hospital network.
• 7:06
  Why bother when there's a side door left wide
• 7:08
  open by a vendor? Exactly. They target the softer,
• 7:12
  perhaps less heavily defended third -party software
• 7:14
  vendor that already holds administrative privileges
• 7:17
  or APITs that grant access to the hospital's
• 7:20
  internal systems. And if the adversary compromises
• 7:23
  the vendor, they just use the vendor's existing
• 7:26
  trusted connections to pivot laterally into the
• 7:29
  hospital's network. Yeah, the attack actually
• 7:31
  originates from inside the perimeter. It bypasses
• 7:34
  traditional external defenses entirely. Which
• 7:37
  means the blast radius of... supply chain attack
• 7:39
  is just exponential. One successful breach of
• 7:43
  a vendor like HMS yields dozens, maybe hundreds
• 7:46
  of downstream victims. It's a domino effect.
• 7:49
  And because of that architecture, organizations
• 7:51
  cannot afford to simply hope their vendors stay
• 7:53
  secure. Hope is definitely not a strategy. You
• 7:56
  need actionable, layered defense strategies to
• 7:58
  ensure you survive when one of your key vendors
• 8:00
  inevitably gets compromised. Resilience has to
• 8:03
  be engineered into the architecture from day
• 8:05
  one. The source reports analyzing the HMS incident
• 8:08
  layout very specific countermeasures that organizations
• 8:11
  are urged to adopt immediately. Let's get into
• 8:14
  those. What are we looking at? We are looking
• 8:15
  at rigorous vendor security reviews, maintaining
• 8:18
  isolated offline backups, implementing phishing
• 8:22
  -resistant staff training, actively monitoring
• 8:24
  networks for anomalous behavior, and establishing
• 8:27
  robust incident response plans. So what does
• 8:32
  this all mean? Now, let's tackle the backup strategy
• 8:33
  first, because we hear about this all the time.
• 8:36
  Yeah, it's a critical one. Like, I want to use
• 8:38
  an analogy here. It's like having a digital fireproof
• 8:41
  safe, right? If your house, which is the primary
• 8:43
  network. burns down, the documents in that completely
• 8:47
  separate, disconnected safe survive perfectly
• 8:51
  intact. That's a great way to visualize it. For
• 8:54
  an IT literate audience, we know the basic concept
• 8:57
  of an error gap, but the reality of implementing
• 8:59
  it today is incredibly complex. Oh, absolutely.
• 9:01
  Because you have organizations relying on continuous
• 9:04
  automated cloud synchronization just to meet
• 9:07
  these aggressive recovery time objectives. Right.
• 9:10
  And if your data is constantly syncing to the
• 9:12
  cloud so you can restore it. in five minutes,
• 9:14
  you don't actually have a true air gap. Because
• 9:16
  if it's connected, the ransomware can reach it.
• 9:18
  That is the central architectural tension right
• 9:20
  there. Organizations think they are protected
• 9:23
  because their data replicates to a secondary
• 9:25
  cloud environment every few minutes. But if that
• 9:28
  cloud repository is constantly connected to the
• 9:31
  live production network via active credentials,
• 9:33
  ransomware will simply travel across that connection
• 9:36
  and encrypt the backup simultaneously. Wow. So
• 9:39
  the backups become useless. Completely. True
• 9:42
  isolated backups require immutable storage. Break
• 9:46
  down how immutable storage functions as a defense
• 9:49
  against a supply chain attack. What does that
• 9:51
  actually look like? Immutability means that once
• 9:53
  data is written to the backup target, it cannot
• 9:56
  be altered, encrypted, or deleted by anyone,
• 9:58
  not even someone possessing the highest level
• 10:00
  of administrative privileges. Really? For how
• 10:02
  long? For a predetermined period set by the policy.
• 10:05
  So if Dragonforce compromises a vendor, uses
• 10:08
  that trusted connection to gain domain admin
• 10:10
  rights on your local network, and then attempts
• 10:12
  to wipe your backups to force a ransom payment,
• 10:15
  the immutable storage simply rejects the command.
• 10:19
  That is brilliant. The data just remains locked
• 10:21
  in a read -only state. Exactly. But implementing
• 10:24
  this requires separating the control plane of
• 10:27
  your backups from your primary network's active
• 10:29
  directory. Right. So if your primary identity
• 10:31
  provider is compromised, the threat actor still
• 10:34
  cannot access the backup infrastructure. Yes,
• 10:36
  because it relies on an entirely different isolated
• 10:39
  authentication mechanism. Okay, that secures
• 10:42
  the data payload. But let's look at the human
• 10:44
  element, because the reports heavily emphasize
• 10:48
  fishing resistance staff training. This raises
• 10:51
  an important question. How do you actually execute
• 10:53
  phishing resistant training in a health care
• 10:56
  environment where the staff are medical professionals
• 10:58
  operating under immense stress? Yeah, I mean,
• 11:01
  they are often fatigued dealing with life or
• 11:04
  death patient care. You can't just mandate an
• 11:07
  annual multiple choice cybersecurity quiz and
• 11:10
  expect a triage nurse at the end of a 12 hour
• 11:12
  shift to meticulously scrutinize the URL of an
• 11:15
  urgent portal login email. It's completely unrealistic.
• 11:18
  Human fatigue will eventually over. ride training
• 11:20
  every single time. So what's the alternative?
• 11:23
  That is exactly why the industry is shifting
• 11:25
  the definition of phishing resistant. It no longer
• 11:29
  means training humans to perfectly spot phishing
• 11:32
  emails. It means deploying authentication technology
• 11:35
  that resists phishing even if the human makes
• 11:37
  a mistake. Okay, like what? Give me an example.
• 11:40
  We are talking about hardware security keys,
• 11:43
  like FIDO2 tokens. Oh. Right. So if a doctor
• 11:47
  clicks a malicious link that perfectly spoofs
• 11:50
  the health management system's login page and
• 11:53
  they type in their password. The attacker gets
• 11:55
  the password. But they can't do anything with
• 11:57
  it. Exactly. The attacker cannot complete the
• 12:00
  login without physically possessing the doctor's
• 12:02
  hardware token. The technology provides the safety
• 12:05
  net that human awareness training simply cannot
• 12:07
  guarantee. That makes so much sense. Which brings
• 12:10
  us to the concept of active network monitoring.
• 12:12
  If a credential does get stolen. or a vendor's
• 12:15
  trusted connection is hijacked, we need to catch
• 12:18
  it immediately. We have to operate under the
• 12:20
  assume breach mentality. We assume Dragon Force
• 12:23
  is already inside the house. So active monitoring,
• 12:26
  specifically endpoint detection and response
• 12:28
  tools combined with behavioral analytics, looks
• 12:31
  for the anomalies that occur after the initial
• 12:34
  intrusion. Because ransomware attacks don't usually
• 12:36
  deploy the encryption payload the millisecond
• 12:39
  they breach the perimeter, do they? No, rarely.
• 12:41
  There's a dwell time. The attackers move laterally.
• 12:44
  They escalate privileges. They map out the network
• 12:46
  to find the most sensitive patient. data and
• 12:48
  they slowly exfiltrate it. And active monitoring
• 12:51
  flags that exact behavior. It does. It alerts
• 12:54
  the security operations center that, say, a vendor
• 12:57
  service account, which normally only communicates
• 13:00
  with the billing server at 2 .00 p .m., is suddenly
• 13:03
  trying to access the medical imaging database
• 13:05
  at 3 .00 a .m. That is a massive. behavioral
• 13:09
  red flag. And it allows the security team to
• 13:11
  isolate the compromised segment before the extortion
• 13:14
  cycle even begins. Let's shift to the preventative
• 13:17
  side of this equation for a second. The reports
• 13:19
  emphasize conducting rigorous vendor security
• 13:21
  reviews. But, I mean, a lot of organizations
• 13:24
  view this as just a compliance checkbox, don't
• 13:26
  they? Unfortunately, yes. Sending a massive spreadsheet
• 13:30
  of questions to a vendor and just filing away
• 13:32
  their answers. How do we make this a functional
• 13:34
  defense mechanism against something as severe
• 13:37
  as the HMS breach? A functional vendor security
• 13:40
  review requires moving beyond self -attestation.
• 13:44
  You cannot just ask a vendor if they are secure.
• 13:46
  You have to demand proof. Like actual audits.
• 13:49
  Exactly. This involves requiring independent
• 13:52
  third -party audits, like a SOC2 Type 2 report,
• 13:56
  which verifies that the vendor's security controls
• 13:59
  have been actively tested and proven effective
• 14:01
  over a continuous period, usually 6 to 12 months.
• 14:04
  That's way better than the spreadsheet. It also
• 14:06
  involves scrutinizing their software bill of
• 14:08
  materials. That is a critical point. A software
• 14:11
  bill of materials, or SBOM, basically tells you
• 14:14
  all the open source and third -party components
• 14:17
  the vendor used to build their software, right?
• 14:19
  It is the ingredient list. If a major vulnerability
• 14:22
  is discovered in a common open source logging
• 14:24
  library, you need the vendor's SBOM to instantly
• 14:28
  know if the software you purchased from them
• 14:30
  contains that vulnerable component. Wow, okay.
• 14:32
  Furthermore, a rigorous review dictates how you
• 14:35
  manage the vendor's access to your environment.
• 14:37
  You have to apply the principle of least privilege.
• 14:40
  So if the HMS software only needs to read demographic
• 14:43
  data, you ensure the service account it uses
• 14:46
  has... Absolutely zero right access. And zero
• 14:49
  access to other databases. You restrict the vendor's
• 14:52
  lateral movement before an attack ever occurs.
• 14:55
  And when all those defenses fail, because let's
• 14:57
  face it, sometimes they do, when the vendor is
• 15:00
  breached, the attacker bypasses the monitoring
• 15:02
  and the network is suddenly compromised. Organizations
• 15:06
  need robust incident response plans. The reports
• 15:09
  note this is the final backstop to avoid paying
• 15:11
  ransoms. But an incident response plan cannot
• 15:14
  just be a dusty PDF. Sitting on an IT director's
• 15:17
  hard drive. Especially because if the network
• 15:18
  is encrypted by Dragonforce, you will not even
• 15:21
  be able to open that PDF. Exactly. A robust incident
• 15:24
  response plan is a heavily rehearsed operational
• 15:26
  protocol. It requires conducting regular tabletop
• 15:29
  exercises that involve not just the IT security
• 15:31
  team, but executive leadership, legal counsel,
• 15:35
  and public relations. Walk us through the mechanics
• 15:37
  of that in the heat of a breach. What does a
• 15:40
  robust plan actually look like when the screens
• 15:44
  suddenly go dark? First, it establishes out -of
• 15:47
  -band communication. If Dragonforce compromises
• 15:50
  your email servers and internal chat applications,
• 15:53
  your incident response team cannot use those
• 15:55
  tools to coordinate the defense. Because the
• 15:58
  attackers are literally watching the chat. Exactly.
• 16:00
  You need pre -established secure external communication
• 16:04
  channels, like a separate secure messaging instance
• 16:07
  deployed entirely on mobile devices. That makes
• 16:10
  sense. What's next? Second, the plan defines
• 16:12
  clear decision matrices and authorities. In the
• 16:15
  middle of a Friday night cyber attack, who specifically
• 16:17
  has the legal and operational authority to sever
• 16:20
  the hospital's connection to the Internet, who
• 16:22
  has the authority to take critical patient care
• 16:25
  systems offline to prevent the spread of the
• 16:27
  infection? You cannot be making those decisions
• 16:29
  by committee while data is actively being exfiltrated.
• 16:32
  No, you need predefined playbooks. And crucially,
• 16:36
  a robust plan details the exact procedure for
• 16:39
  failing over to manual paper -based operations
• 16:41
  in a clinical setting. Right. Medical staff need
• 16:43
  to know exactly how to continue triaging patients,
• 16:46
  tracking medications, and routing lab results
• 16:48
  without the software they rely on every single
• 16:51
  day. The smoother the transition to manual operations,
• 16:55
  the less pressure the organization faces to pay
• 16:57
  the ransom to restore digital services. The entire
• 17:00
  goal of these layered defenses, from immutable
• 17:03
  backups to vendor reviews to rehearsed incident
• 17:06
  plans, is to systematically remove the attacker's
• 17:09
  leverage. This entire situation just forces us
• 17:12
  to take a hard, critical look at the architecture
• 17:14
  we are building. The health management system's
• 17:17
  breach illustrates a profound tension in modern
• 17:19
  IT. Which honestly brings me to a final thought
• 17:22
  I want to leave you with today. I'd love to hear
• 17:24
  it. As we rush headlong to adopt more deeply
• 17:26
  integrated software, constantly striving to make
• 17:28
  healthcare, finance, and critical infrastructure
• 17:30
  faster and more efficient, are the very tools
• 17:34
  and connections designed to optimize our operations
• 17:36
  actually becoming our greatest structural vulnerabilities?
• 17:40
  We are building ecosystems of incredible efficiency,
• 17:43
  but we are simultaneously centralizing the risk.
• 17:46
  It's a paradox the industry really must solve.
• 17:49
  That's very true. The connectivity that grants
• 17:51
  us operational power is the exact same connectivity
• 17:54
  that introduces immense shared vulnerability.
• 17:58
  Navigating the balance between integration and
• 18:00
  isolation is arguably the defining cybersecurity
• 18:03
  challenge we face today. If today's conversation
• 18:05
  got you thinking about your own network architecture.
• 18:08
  You know, the trusted pathways you have granted
• 18:10
  to third -party vendors and your organization's
• 18:13
  readiness to handle a supply chain compromise.
• 18:15
  Do not wait for a prominent vendor to make headlines
• 18:18
  before you take action. You really need to be
• 18:20
  proactive. I highly encourage you to visit www
• 18:23
  .kinsoft .com .au to discuss your security and
• 18:28
  IT needs with the experts. You can start engineering
• 18:31
  resilience into your infrastructure today before
• 18:34
  the ticking clock ever starts. Thank you for
• 18:36
  taking the time to explore the mechanics of this
• 18:38
  threat landscape with us. Stay vigilant. Keep
• 18:40
  questioning the systems around you, and we will
• 18:42
  catch you on the next one.