SamSam Ransomware Infected Thousands of LabCorp Systems
Via Brute Force RDP
“LabCorp, one of the largest clinical labs in the U.S.”, said the SamSam ransomware attack that forced their systems offline was contained quickly and didn’t result in a data breach.
However, in the brief time between detection and mitigation, the ransomware was able to encrypt thousands of systems and several hundred production servers.
The wider public first learned about the LabCorp incident on Monday when the company disclosed it via an 8-K filing with the SEC. Since then, as recovery efforts continue, the company said they’re at about 90-percent operational capacity.
According to sources familiar with the investigation, the SamSam attack at LabCorp started at midnight on July 13. The LabCorp SOC (Security Operation Center) immediately took action after that first system was encrypted, alerting IR teams and severing various links and connections.
These quick actions ultimately helped the company contain the spread of the infection and neutralize the attack within 50 minutes. However, before the attack was fully contained, 7,000 systems and 1,900 servers were impacted. Of those 1,900 servers, 350 were production servers.”
Source: KnowBe4.com
