Pharmaceutical industry – a new El Dorado for cybercriminals
According to the latest report prepared by Blueliv in collaboration with DAGMA Bezpieczeństwo IT, over the years the pharmaceutical industry has become one of the more valuable targets for cybercriminals. The threat from, among others, ransomware and targeted attacks could significantly hinder the ongoing global search for a COVID-19 vaccine.
In the face of the SARS-CoV-2 coronavirus pandemic, there are increasingly frequent media reports about cyberattacks aimed at institutions searching for a vaccine. This situation highlights the scale of threats that the pharmaceutical industry has to deal with on a daily basis. According to the latest report prepared by Blueliv in collaboration with DAGMA Bezpieczeństwo IT, most of them are aimed at taking control of intellectual property held by pharmaceutical companies.
In the crosshairs: drug research results
According to the report, the incidents the pharmaceutical industry has to contend with are predominantly well-prepared targeted attacks, often backed by groups in the service of specific states or competing companies. Such an attack can take the form of theft of confidential information, e.g. the results of research on a new drug, but it does not have to – targeted attacks using ransomware (encryption software) pose an equally serious threat. BEC attacks are also a serious problem, involving taking control of one of the company's email accounts and using it to extort funds or information.
- The common denominator of most of the described incidents is the high value of the data held by pharmaceutical companies. Drug research consumes enormous resources, but can bring tangible financial and even political benefits. Therefore, cases of industrial espionage or the existence of cybercriminal groups specializing in attacks against the pharmaceutical industry should not come as a surprise – explains Krystian Paszek, head of the audit department at DAGMA Bezpieczeństwo IT.
Who is behind the attacks on the pharmaceutical sector?
One such group is the China-based APT41, which targeted organizations of strategic importance in many countries, including Poland. Its list also included victims associated with healthcare and the pharmaceutical industry.
More information on attacks aimed at the pharmaceutical industry can be found in the full report: Sounding the Pharma Alarma: An overview of the pharmaceutical threat landscape (EN)
Summary
The Blueliv and DAGMA Bezpieczeństwo IT report indicates that the pharmaceutical industry has become a key target for cybercriminals who, through targeted attacks, ransomware and BEC attacks, seek to take over companies' intellectual property. This threat is particularly acute during the pandemic and the work on a COVID-19 vaccine.
An example of groups operating in this area is the Chinese APT41, which attacked, among others, healthcare organizations in Poland. Experts emphasize that the motivation is enormous financial and political gain, and the victims include not only corporations but also research institutions.
