shinyhunters Ransomware Claims New Victim: NovoCure Limited | Healthcare Sector

Executive Summary

The ransomware group shinyhunters publicly claimed responsibility for compromising NovoCure Limited, a healthcare organization operating in Israel. The breach introduces immediate operational risk to patient‑care services and triggers potential liability under Israeli data‑protection law. Executive leadership must decide within hours whether to activate the incident‑response plan, engage external forensics, and notify regulators.

Verified Facts

• shinyhunters ransomware group announced a new victim named NovoCure Limited — article.
• The victim operates in the healthcare sector — article.
• The victim is located in Israel (IL) — article.
• The leak site publishing the claim is https://www.ransomware.live/id/Tm92b0N1cmUgTGltaXRlZEBzaGlueWh1bnRlcnM/ — article.

Threat Classification

Threat type: Ransomware (HIGH CONFIDENCE). Affected sector: Healthcare (HIGH CONFIDENCE). Geographic scope: Israel, with potential spill‑over to any organization handling similar data (MEDIUM CONFIDENCE). Exploitation status: Active campaign (HIGH CONFIDENCE). Attacker motivation: Financial gain inferred from ransomware extortion model (ANALYST ASSESSMENT, MEDIUM CONFIDENCE).

Threat Severity Assessment

• Active ransomware campaign targeting a critical healthcare provider – HIGH CONFIDENCE.
• Potential encryption of patient‑record systems could halt clinical operations – HIGH CONFIDENCE.
• Public leak site indicates data exfiltration and extortion pressure – MEDIUM CONFIDENCE.
• Healthcare data is subject to strict privacy regulations, increasing compliance risk – MEDIUM CONFIDENCE.

Business Impact

Operational disruption: Encryption of electronic health records could suspend patient treatment workflows for days, forcing manual charting and increasing staff overtime. Regulatory liability: Under Israel’s Protection of Privacy Law, fines can reach up to 10 million NIS per breach, and mandatory breach notification within 72 hours may be required. Financial exposure: Direct ransom demand (not disclosed) plus remediation costs place the incident in the “high” financial exposure tier. Reputational damage: Public disclosure of patient data loss will erode trust among patients, insurers, and referral networks, potentially reducing referral volume by double‑digit percentages.

Technical Analysis

The article provides no technical details about the intrusion vector, malware payload, or exploited vulnerability. Consequently, the specific delivery mechanism, encryption routine, or persistence technique employed by shinyhunters remains unknown at this time.

MITRE ATT&CK Mapping

• Impact → T1486: Data Encrypted for Impact — the claim identifies shinyhunters as a ransomware actor that encrypts victim data.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for hunting shinyhunters ransomware activity:

• Mass file renaming to a uniform ransomware extension (e.g., “.locked”).
• Creation of processes that spawn child processes with high entropy command‑line arguments.
• Outbound network connections to newly‑registered domains within the first 24 hours of infection.
• Use of Windows built‑in tools (e.g., certutil, bitsadmin) to stage payloads before encryption.

Detection Engineering Guidance

• Collect Sysmon Event ID 11 (FileCreate) and filter for TargetFilename ending in “.locked” to flag encryption activity.
• Monitor Sysmon Event ID 1 (ProcessCreate) for parent‑child chains where a newly‑executed binary launches multiple child processes within 30 seconds.
• Enable Windows Security Event ID 4663 (Object Access) on directories containing patient data and alert on “WRITE_DATA” actions from unknown executables.
• Correlate DNS query logs for domains with registration dates < 7 days and no prior reputation.
• Integrate endpoint telemetry (EDR) to flag PowerShell commands containing “-EncodedCommand” that execute from temporary paths.

Sigma Rules

title: ShinyHunters Ransomware File Encryption
id: e3b0c442-98fc-1c14-9a2b-3c4d5e6f7a89
status: stable
description: Detects creation of files with the .locked extension, a hallmark of ShinyHunters ransomware encryption.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|endswith: '.locked'
  condition: selection
falsepositives:
  - Legitimate applications that use .locked for temporary storage
level: high
tags:
  - attack.t1486

Threat Hunting Queries

• Hypothesis: Ransomware encryption of patient files – Source: Sysmon (EventID 11) where TargetFilename ends with “.locked”.
• Hypothesis: Credential dumping prior to encryption – Source: Windows Security (EventID 4663) on LSASS.exe process accesses.
• Hypothesis: Use of built‑in Windows utilities for payload staging – Source: Sysmon (EventID 1) with Image containing “certutil.exe” or “bitsadmin.exe”.
• Hypothesis: Lateral movement via SMB shares – Source: Windows Security (EventID 5140) for new share connections from a low‑privilege host.
• Hypothesis: Exfiltration to newly registered domains – Source: DNS logs where query domain registration date < 7 days and no prior reputation.

SOC Analyst Playbook

• P0 – Immediate (0‑1 hr): Verify alert on .locked file creation; isolate the endpoint at network level; capture volatile memory with FTK Imager.
• P0 – Immediate (0‑1 hr): Pull latest Sysmon and Security logs from the host; forward to the IR team.
• P1 – Urgent (1‑4 hr): Execute PowerShell “Get-Process” on the host to enumerate suspicious child processes; block associated hashes in the firewall.
• P1 – Urgent (1‑4 hr): Reset local and domain credentials for accounts observed on the compromised host.
• P2 – Same‑day (4‑8 hr): Run a full endpoint scan with the EDR vendor’s ransomware detection module; begin forensic imaging of critical servers.

Executive Decision Matrix

🔗 Related Intelligence Reports

• Related topic: qilin Ransomware Claims New Victim: Cinépolis | Hospitality Sector
• Related topic: qilin Ransomware Claims New Victim: iPic | Hospitality Sector
• Related topic: spacebears Ransomware Claims New Victim: Freelom
• Related topic: spacebears Ransomware Claims New Victim: holzmarkt chemnitz | Retail & E-Commerce Sector
• Related topic: qilin Ransomware Claims New Victim: Quaker State Mexico | Energy & Utilities Sector