Sol Threat Intelligence

June 2026
Healthcare and Hospitals
Regional Sector Brief

1 Jun to 30 Jun 20263 regional assessments4 pages per regionPrepared by Kaartheeswaran Ravichandran

A futuristic hospital complex protecting clinical systems from a cyber intrusion

Americas

Executive Summary

Specialized healthcare attack pipelines dominate the most heavily documented region

The Americas Healthcare and Hospitals sector had the strongest and most detailed intelligence coverage in the source set. Insomnia targeted US healthcare through encryptor-free data theft and WSUS abuse. Sinobi focused on mid-market health systems through SonicWall and MSP credentials. INC Ransomware expanded BYOVD EDR termination and Veeam credential theft, while the Code Blue assessment documented 233 million exposed records, 35 breaches and 37 weaponized CVEs across the broader healthcare landscape. Pediatric hospitals remained high-value targets because stolen child identity data can retain criminal value for more than a decade.

Key Insights

Insomnia targeted US healthcare with data theft only and used WSUS for artifact-light lateral movement.

Sinobi exceeded 250 victims and used SonicWall VPN and MSP credentials as its primary entry path.

INC Ransomware exceeded 800 victims and introduced ProcessTerminator.exe with three vulnerable drivers.

A dedicated Veeam credential dumper targeted healthcare backup infrastructure directly.

Fortinet CVE-2024-55591 was the most-referenced healthcare vulnerability in the macro-analysis.

Pediatric healthcare remained a priority for Rhysida, INC, LockBit and Vanilla Tempest.

Top threat entities and June trend shifts

InsomniaData-theft extortion

US-healthcare-focused operation using purchased credentials and WSUS, with no encryption or negotiation.

SinobiRansomware

Fast-growing mid-market RaaS using SonicWall, MSP credentials, rogue admin accounts and cloud exfiltration.

INC / GOLD VICTORRansomware

Top-tier RaaS using BYOVD, Veeam credential theft and confirmed pediatric hospital targeting.

Lazarus / MedusaNation-state plus RaaS

Combines nation-state tradecraft with healthcare double-extortion infrastructure.

Lumma / StealC / RhadamanthysInfostealers

Feed credential markets used for healthcare initial access.

Rhysida / LockBitRansomware

Active against children's hospitals and long-lived pediatric identity data.

Trend shifts versus May 2026

Healthcare ransomware became increasingly specialized around hospital infrastructure and MSP dependencies.

Encryptor-free extortion challenged conventional backup-first response models.

BYOVD became a practical method for defeating healthcare EDR deployments.

Backup systems became direct targets through Veeam credential extraction.

SonicWall and Fortinet edge appliances remained dominant entry surfaces.

Attack chains, vulnerabilities and indicators

CVE	Product	Severity	June context
CVE-2024-55591	Fortinet FortiOS / FortiProxy	Critical	Most-cited healthcare CVE
CVE-2024-53704	SonicWall SSL VPN	Critical	Sinobi authentication bypass
CVE-2024-40766	SonicWall	High	Improper access control and migration risk
CVE-2023-3519	Citrix NetScaler	Critical	INC initial access
CVE-2023-48788	Fortinet EMS	Critical	INC exploitation
CVE-2025-5777	Citrix NetScaler	Critical	INC initial access
CVE-2020-1472	Windows Zerologon	Critical	Legacy hospital AD takeover risk

Insomnia healthcare extortion

Attack PathELEZAR

Purchase infostealer credentials

T1650

Authenticate with valid accounts

T1078

Abuse WSUS for lateral movement

T1072

Collect patient and administrative data

T1005

Exfiltrate over web services

T1567

Publish data freely with no decryptor or negotiation

T1657

Sinobi mid-market hospital intrusion

Attack PathELEZAR

Compromised MSP SonicWall credentials

T1133

RDP into file server

T1078.002

Uninstall Carbon Black EDR

T1562.001

Create rogue admin and domain-admin accounts

T1136.001

Discover backups and network shares

T1083

RClone and WinSCP exfiltration

T1567.002

Curve25519 and AES encryption with .SINOBI extension

T1486

INC healthcare ransomware

Attack PathELEZAR

Public-app or remote-access compromise

T1190

ProcessTerminator.exe drops vulnerable drivers

T1562.001

Kill EDR with filwfp.sys, filnk.sys and fildds.sys

Veeam-Get-Creds.ps1 extracts backup credentials

T1003

Network discovery and cloud exfiltration

T1046 · T1567.002

DeviceIoControl-based recovery inhibition

T1490

Encryption and double extortion

T1486

Selected indicators

Type	Indicator	Attribution
Onion	i62huw7ve22rpyw6lnq3kmfump2dmsg4xpveec3ere73njwatrz74gad[.]onion	Insomnia DLS
File	rclone-ssh.conf / bin.exe / .SINOBI	Sinobi
SHA256	1b2a1e41a7f65b8d9008aa631f113cef36577e912c13f223ba8834bbefa4bd14	Sinobi
File	ProcessTerminator.exe / Veeam-Get-Creds.ps1	INC
Driver	filwfp.sys / filnk.sys / fildds.sys	INC BYOVD
File	INC-README.txt	INC ransom note
Domain	incblog[.]su	INC leak site

Prioritized defensive guidance

Recommendations are calibrated for clinical systems, EHR and PACS environments, hospital Active Directory, remote-access appliances, backup infrastructure, MSP dependencies and patient-safety continuity.

Immediate: act within 72 hours

1. Audit WSUS administration and out-of-window deployments.

2. Patch SonicWall CVE-2024-53704 and CVE-2024-40766.

3. Block INC ProcessTerminator.exe and its vulnerable drivers.

Urgent: act within 2 weeks

1. Restrict Veeam SQL access and protect backup credentials.

2. Deploy infostealer detection on clinical endpoints.

3. Patch Fortinet CVE-2024-55591.

4. Review all MSP remote access and remove over-privileged accounts.

Strategic uplift

1. Create an Insomnia-specific data-theft response playbook.

2. Review pediatric hospital data segmentation and Discord access.

3. Reduce single-vendor clearinghouse dependency and isolate critical workflows.

4. Detect DeviceIoControl-based recovery inhibition and monitor healthcare credential leaks.

June source reports: HivePro Insomnia and Sinobi reporting, HiveForce Labs Code Blue analysis, Acronis INC ransomware research and PolySwarm pediatric healthcare analysis.

EMEA

Executive Summary

Ransomware, FortiGate credential theft and Teams vishing converge on hospitals

EMEA Healthcare and Hospitals faced a June threat environment shaped by ransomware-as-a-service, perimeter credential theft and social engineering. The Gentlemen emerged as the most operationally important ransomware group, with confirmed healthcare targeting, a documented healthcare case study, European infrastructure and domain-wide GPO deployment. FortiBleed confirmed dedicated European credential collection from FortiGate environments, while Microsoft Teams vishing campaigns directly targeted healthcare employees and executed Kerberoasting during live support impersonation sessions. Insomnia and pediatric-focused ransomware activity added further data-extortion and long-duration identity-theft risk.

Key Insights

The Gentlemen reached top-10 ransomware status and documented healthcare targeting through a full enterprise kill chain.

FortiBleed operator infrastructure included a dedicated results_EU directory for harvested FortiGate credentials.

Microsoft Teams vishing directly targeted healthcare staff and progressed to Kerberoasting in a single call.

Insomnia targeted healthcare through data theft only, making backup recovery irrelevant.

Rhysida, INC, LockBit and Vanilla Tempest remained active against pediatric healthcare.

The wider June corpus rose from 164 to 455 reports, increasing exposure across all healthcare attack surfaces.

Top threat entities and June trend shifts

The GentlemenRansomware

Healthcare-targeting RaaS using Go and C variants, BYOVD, Yamux C2 and GPO-based domain-wide deployment.

FortiBleed operatorCredential-harvesting campaign

Captured FortiGate traffic and maintained dedicated European results infrastructure.

Microsoft Teams vishing actorsSocial engineering

Used fraudulent tenants, Quick Assist and PowerShell Kerberoasting against healthcare staff.

InsomniaData-theft extortion

No encryptor and no negotiation, with stolen healthcare data published freely.

Rhysida / INC / LockBitRansomware

Confirmed interest in pediatric healthcare and long-lived patient identity data.

Iranian-aligned Teams actorsNation-state

Observed abusing Teams external access alongside financially motivated operators.

Trend shifts versus May 2026

Teams-based support impersonation matured into a healthcare-specific initial-access method.

FortiGate credential capture created a direct path from perimeter compromise to Active Directory abuse.

Ransomware operators increasingly used kernel drivers and GPO for rapid enterprise-wide impact.

Encryptor-free extortion reduced the value of backup-only response strategies.

Pediatric data remained uniquely valuable because abuse can persist undetected for 10 to 18 years.

Attack chains, vulnerabilities and indicators

CVE	Product	Severity	June context
CVE-2024-55591	Fortinet FortiOS / FortiProxy	Critical	Healthcare perimeter exposure
CVE-2025-22457	Ivanti Connect Secure	Critical	Remote clinical access risk
CVE-2025-31324	SAP NetWeaver	Critical	Hospital enterprise application risk
CVE-2026-35273	Oracle PeopleSoft	Critical	Hospital HR and finance exposure

The Gentlemen healthcare intrusion

Attack PathELEZAR

Internet-facing VPN or firewall compromise

T1190

AD enumeration with SharpADWS

T1087.002

Go backdoor over TCP 9443 and Yamux

T1095

BYOVD EDR termination

T1562.001

NETLOGON and SYSVOL ransomware deployment

T1484.001

gpupdate /force across domain

Hyper-V shutdown, shadow-copy deletion and encryption

T1486

FortiBleed credential factory

Attack PathELEZAR

Passive FortiGate packet capture

T1040

Extract NTLM, Kerberos, RADIUS and session material

Credential validation and spraying

T1110.003

SPN and AS-REP enumeration

T1558.003

DFS and SMB collection

T1039

Large-scale exfiltration to operator infrastructure

T1020

Teams vishing to Kerberoasting

Attack PathELEZAR

External Teams contact

IT-helpdesk impersonation call

T1566.004

Quick Assist or TeamViewer session

T1219

PowerShell SPN queries

T1059.001

$krb5tgs$23$ hash extraction

T1558.003

Archive and exfiltration to file-sharing service

T1567

Selected indicators

Type	Indicator	Attribution
IP	81[.]177[.]215[.]15:9443	The Gentlemen backdoor C2
File	gentle.exe / deploy_gpo.ps1 / ScheduledTasks.xml	The Gentlemen
Task	UpdateUser / TaskSystem	The Gentlemen persistence
IP	193[.]8[.]187[.]42 / 85[.]11[.]187[.]8	FortiBleed
Path	/root/sniff/base/results_EU/	FortiBleed European results
Domain	helpdeskwindowsfamily[.]onmicrosoft[.]com	Teams vishing
Pattern	$krb5tgs$23$	Kerberoasting output

Prioritized defensive guidance

Immediate: act within 72 hours

1. Rotate FortiGate VPN credentials and revoke active sessions.

2. Block The Gentlemen C2 and hunt its backdoor, tasks and registry persistence.

3. Restrict Teams external access and prohibit unverified remote-support sessions.

Urgent: act within 2 weeks

1. Protect SYSVOL, NETLOGON and GPO from unauthorized modification.

2. Block The Gentlemen BYOVD drivers and Defender-disabling changes.

3. Restrict WSUS administration to approved service accounts.

4. Block unauthorized file-sharing and Discord-based exfiltration channels.

Strategic uplift

1. Detect bulk Kerberos service-ticket requests and weak SPN accounts.

2. Include live memory capture in ransomware response for potential Gentlemen key recovery.

3. Review pediatric patient-data segmentation and long-term identity risks.

4. Deploy Yamux and TCP 9443 network detection.

June source reports: Kaspersky and Dark Atlas reporting on The Gentlemen, Arctic Wolf FortiBleed analysis, CyberProof Teams vishing research, HivePro Insomnia reporting and PolySwarm pediatric healthcare analysis.

APAC

Executive Summary

Global healthcare threat patterns apply, but June regional reporting remains limited

APAC Healthcare and Hospitals faced a materially elevated threat environment in June 2026, but the supplied source set contained no APAC-specific healthcare incident report for the month. The principal intelligence source was HiveForce Labs' global healthcare analysis, which documented 35 disclosed breaches, 37 exploited CVEs and approximately 233 million exposed records from January 2025 through June 2026. Regional relevance is strongest where actor evidence is direct, particularly Lazarus Group's adoption of Medusa RaaS and the exposure of APAC hospitals to the same internet-facing appliance, credential-stealer and double-extortion attack paths. This section keeps confirmed reporting separate from regional inference.

Key Insights

No June 2026 report in the supplied material names a confirmed APAC healthcare victim.

Lazarus Group's adoption of Medusa RaaS is the strongest actor-level development with direct APAC relevance.

Double-extortion by Medusa, Interlock and Anubis remained the dominant global healthcare attack model.

Lumma, StealC and Rhadamanthys represented 24 percent of healthcare malware in the analysis window.

Seventy-eight percent of exploited CVEs were already listed in CISA KEV, showing patch lag rather than zero-days as the main vulnerability.

APAC nation-state campaigns active in adjacent sectors increased proximity risk to health ministries and state-owned hospital networks.

Top threat entities and June trend shifts

Lazarus GroupNation-state

Confirmed adoption of Medusa RaaS, combining nation-state tradecraft with criminal double-extortion capability.

MedusaRansomware

Healthcare-focused RaaS with double-extortion and operational relevance to Lazarus-linked activity.

InterlockRansomware

Part of the dominant healthcare double-extortion pattern documented in the global source set.

AnubisRansomware

Causes irreversible destruction in addition to encryption, creating severe clinical continuity risk.

Lumma / StealC / RhadamanthysInfostealers

Harvest credentials, cookies and tokens used to seed later ransomware intrusions.

APT37 / CL-STA-1062Nation-state proximity

Active in South Korea and Southeast Asia during June, but no healthcare victim was confirmed in the source material.

Trend shifts versus May 2026

Regional reporting remained sparse despite a 177 percent rise in the wider June corpus.

Healthcare risk continued to be driven by known, patchable edge-device vulnerabilities.

Credential-stealer activity remained a major precursor to ransomware access.

Anubis-style destructive impact raised the cost of recovery beyond conventional ransomware scenarios.

Cross-sector nation-state campaigns created adjacency risk without direct healthcare victim confirmation.

Attack chains, vulnerabilities and indicators

CVE	Product	Severity	June context
CVE-2024-55591	Fortinet FortiOS / FortiProxy	Critical	Most-referenced healthcare CVE in the source analysis
CVE-2025-22457	Ivanti Connect Secure	Critical	Relevant to hospital remote-access infrastructure
CVE-2025-31324	SAP NetWeaver	Critical	Hospital administrative platform exposure
CVE-2026-35273	Oracle PeopleSoft	Critical	Hospital HR and finance systems potentially exposed

Healthcare double-extortion

Attack PathELEZAR

Exploit public-facing VPN, firewall or gateway

T1190

Stealer-harvested credentials or valid accounts

T1078.002

Web shell, Windows service or Run-key persistence

T1505.003

RDP and SMB lateral movement

T1021.001

Process injection and security impairment

T1055

Patient-data exfiltration over C2

T1041

EHR encryption, backup deletion and service disruption

T1486 · T1490

Credential-stealer pipeline

Attack PathELEZAR

Malicious download or endpoint compromise

T1204.002

Browser credential and cookie theft

T1555.003

VPN or domain credential replay

T1078

Internal access to clinical networks

T1021

Ransomware operator hand-off

Data theft and encryption

T1041 · T1486

Anubis destructive impact

Attack PathELEZAR

Initial access and lateral movement

Disable defenses and stop services

T1562 · T1489

Exfiltrate clinical and patient data

T1041

Delete recovery artifacts

T1490

Encrypt and irreversibly destroy data

T1486

Clinical downtime and patient-safety impact

T1485

Selected indicators

Type	Indicator	Attribution
MD5	944153fb9692634d6c70899b83676575	Lazarus-linked healthcare activity
MD5	efc80697aa58ab03a10d02a8b00ee740	Healthcare threat campaign
SHA1	c12c4d58541cc4f75ae19b65295a52c559570054	Healthcare threat campaign
SHA256	28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f	Healthcare threat campaign
SHA256	4a97599ff5823166112d9221d0e824af7896f6ca40cd3948ec129533787a3ea9	Healthcare threat campaign

Prioritized defensive guidance

Immediate: act within 72 hours

1. Patch Fortinet CVE-2024-55591 across hospital perimeter systems.

2. Audit Ivanti, Citrix and Palo Alto remote-access appliances for compromise.

3. Block and hunt Lazarus and Medusa indicators in endpoint tooling.

Urgent: act within 2 weeks

1. Deploy infostealer detection on clinical staff endpoints.

2. Protect Volume Shadow Copies and detect recovery-inhibition commands.

3. Restrict RDP to jump hosts and enable Network Level Authentication.

4. Validate offline backups for EHR, PACS, pharmacy and billing systems.

Strategic uplift

1. Patch PeopleSoft CVE-2026-35273 on hospital administrative systems.

2. Audit patient-facing applications for web shells and unauthorized scripts.

3. Create clinical-IT ransomware playbooks with manual fallback procedures.

4. Enable enhanced PowerShell logging and regional healthcare threat sharing.

June source reports: HiveForce Labs, Code Blue: U.S. Healthcare Under Cyber Siege, 15 June 2026, with clearly identified APAC regional inference where no local victim reporting existed.

June 2026Healthcare and HospitalsRegional Sector Brief

Trend shifts versus May 2026

Selected indicators

Trend shifts versus May 2026

Selected indicators

Trend shifts versus May 2026

Selected indicators

June 2026
Healthcare and Hospitals
Regional Sector Brief