Nutex Health Ransomware Breach: Detection and Response Guidance After Gang Claims Theft of Patient, Employee, and Financial Data

Nutex Health, a Houston-based operator of micro-hospitals and hospital outpatient departments, has disclosed to the U.S. Securities and Exchange Commission that threat actors accessed systems containing patient, employee, provider, business, and financial information. A ransomware gang has publicly claimed responsibility for the intrusion — a pattern we've seen accelerate across the healthcare sector, where double-extortion operations (steal first, encrypt second, threaten publication third) have become the default playbook.

If you operate in healthcare — or support organizations that do — treat this as an active warning shot, not a news item. Attackers targeting hospital operators aren't stumbling in; they're deliberately selecting victims whose operations cannot tolerate downtime and whose data carries maximum extortion leverage under HIPAA. Emergency and micro-hospital networks, with their lean IT staffing and high-availability requirements, are precisely the soft underbelly these crews probe for.

Why Healthcare Defenders Need to Act Now

Three factors make this class of incident urgent for every covered entity and business associate:

1. Regulatory exposure compounds fast. Nutex's SEC disclosure reflects the current reality: material cyber incidents trigger 8-K reporting obligations, and breaches of 500+ patient records trigger HHS Office for Civil Rights notification and public listing on the OCR breach portal. The clock starts at discovery, not at forensic confirmation.
2. Double extortion means encryption is only half the damage. Even if your backups survive, the exfiltrated PHI, employee PII, and financial records are already monetized leverage. Detection must target the theft phase, not just the encryption detonation.
3. Healthcare is being prioritized. Ransomware crews have consistently targeted hospital operators, billing providers, and healthcare MSPs because pressure to pay is maximized when patient care is on the line.

Technical Analysis: The Likely Attack Chain

While Nutex has not published specific IOCs or a named CVE associated with this intrusion, the disclosed pattern — unauthorized access followed by claimed data theft and an encryption-based disruption — maps to the standard healthcare ransomware kill chain we respond to repeatedly:

Initial access. Most healthcare ransomware engagements we handle trace back to one of three doors: exposed remote access services (RDP, VPN concentrators, remote monitoring and management tooling), phishing-delivered loaders, or compromised third-party/vendor credentials. The common thread is an internet-facing service with weak or absent MFA.

Establishment and discovery. Post-access, operators enumerate domain trusts, harvest credentials from memory and LSASS, and identify backup infrastructure, EHR-adjacent servers, and file shares containing PHI. Expect use of living-off-the-land binaries — nltest, net.exe, AdFind, SharpHound — because they blend into admin noise.

Exfiltration staging. Before encryption, data is staged into archives (commonly 7z, rar) and pushed out via Rclone, MEGA, or attacker-controlled cloud storage. On a healthcare network, this phase is your last realistic chance to stop the breach from becoming a reportable breach.

Impact. Encryption detonation is typically preceded by defense evasion: shadow copy deletion, backup service termination, and attempts to disable or uninstall EDR agents. Operators push payloads via Group Policy, PsExec, or RMM tooling for domain-wide simultaneity.

Exploitation status: This is a confirmed, active intrusion with claimed data theft — not theoretical. No CVE has been publicly tied to the initial access vector as of this writing, so defenders should focus on behavioral detection rather than signature-chasing.

Detection & Response

The detections below target the behaviors that define this threat class — shadow copy destruction, mass staging and exfiltration, and EDR tampering — because those are observable regardless of which initial access vector the crew used. Deploy and test them now, not after your own 8-K moment.

Sigma Rules

---
title: Shadow Copy Deletion via vssadmin or wmic
description: Detects deletion of volume shadow copies, a hallmark pre-encryption ransomware behavior observed in healthcare intrusions including double-extortion operations.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/10
id: 1f3a7c2e-9b41-4d8e-a6f0-2c5d8e1b3a47
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'resize shadowstorage'
  condition: selection_img and selection_cmd
falsepositives:
  - Rare; some backup solutions manipulate shadow copies legitimately. Whitelist known backup service accounts.
level: high
---
title: Rclone or Cloud Exfiltration Tool Execution
description: Detects execution of Rclone or similar sync tools frequently abused for bulk PHI/data exfiltration prior to ransomware detonation.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/02/10
id: 8c2d4f1a-3e76-4b9c-b5a1-7d0e2f8c4b96
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
  selection_cmd:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--config'
      - '--transfers'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate cloud sync administration. Baseline and alert on non-standard install paths (ProgramData, Temp, user profiles).
level: medium
---
title: Security Tool Tampering or EDR Uninstall Attempt
description: Detects attempts to stop, disable, or uninstall security services — a common pre-encryption defense evasion step in ransomware operations.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/10
id: 4b9e1d7c-6a32-4f8e-c1d5-9a3b7e2f5c18
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'sc stop'
      - 'sc delete'
      - 'sc config'
      - 'net stop'
      - 'UninstallString'
      - 'DisableRealtimeMonitoring'
      - 'Set-MpPreference -Disable'
  selection_target:
    CommandLine|contains:
      - 'defender'
      - 'sentinel'
      - 'crowdstrike'
      - 'carbonblack'
      - 'cbdefense'
      - 'sophos'
      - 'backup'
      - 'veeam'
  condition: selection_cmd and selection_target
falsepositives:
  - IT administrators performing maintenance. Filter on approved admin accounts and change windows.
level: high

KQL Hunt (Microsoft Sentinel / Defender)

This query hunts the combined pre-detonation pattern — shadow copy deletion, mass file staging, and suspicious outbound transfer volume — across your endpoint fleet. In a healthcare environment, run this against EHR-adjacent servers, file shares holding PHI, and any system reachable from clinical workstations:

let lookback = 7d;
let destructiveCmds = dynamic(["delete shadows", "shadowcopy delete", "delete catalog", "recoveryenabled no", "wbadmin delete"]);
let exfilTools = dynamic(["rclone", "megacmd", "winscp", "filezilla"]);
let destructive = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (destructiveCmds)
    | project DestructiveTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let exfil = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (exfilTools) or FileName has_any (exfilTools)
    | project ExfilTime=TimeGenerated, DeviceName, AccountName, ExfilCommand=ProcessCommandLine;
let highEgress = DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any ("mega.nz", "mega.io", "transfer.sh", "temp.sh", "file.io", "anonfiles")
    | summarize Connections=count(), RemoteIPs=make_set(RemoteIP, 10) by DeviceName, RemoteUrl;
destructive
| join kind=leftouter exfil on DeviceName
| join kind=leftouter highEgress on DeviceName
| project DeviceName, AccountName, DestructiveTime, ProcessCommandLine, ExfilTime, ExfilCommand, RemoteUrl, Connections
| order by DeviceName asc

A device appearing in all three result sets within the same 24-48 hour window is a near-certain active ransomware staging operation — isolate it immediately, do not wait for confirmation.

Velociraptor VQL Hunt

Use this artifact to sweep endpoints for ransomware staging artifacts: recently created archives in staging directories, execution of exfiltration tooling from non-standard paths, and shadow copy state:

-- Hunt for ransomware staging: archives in temp paths, exfil tools, shadow copy status
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no)'
   OR Exe =~ '(?i)(rclone|megacmd|winscp)'
   OR Exe =~ '(?i)(programdata|appdata\\\\local\\\\temp|users\\\\public)\\\\[^\\\\]+\.exe$'

-- Enumerate recently created archive files in common staging locations
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/ProgramData/**/*.7z', 'C:/ProgramData/**/*.zip', 'C:/ProgramData/**/*.rar', 'C:/Users/Public/**/*.7z', 'C:/Users/Public/**/*.rar'])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

-- Check shadow copy presence; zero shadows on a server is a red flag post-incident
SELECT * FROM execve(argv=['cmd.exe', '/c', 'vssadmin list shadows'])

Hardening and Verification Script

Run this PowerShell audit (as Administrator) on critical servers — file servers, backup infrastructure, and anything holding PHI — to verify anti-ransomware controls are actually in place. We routinely find organizations that believe these are enabled when they are not:

# Verify Controlled Folder Access (ransomware protection) is enabled
$cfa = Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess
Write-Output "Controlled Folder Access state (1=Enabled, 0=Disabled): $cfa"

# Enable it if disabled
if ($cfa -ne 1) { Set-MpPreference -EnableControlledFolderAccess Enabled; Write-Output "Controlled Folder Access ENABLED." }

# Confirm real-time protection and tamper protection status
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, IsTamperProtected, AntivirusEnabled | Format-List

# List current shadow copies - investigate if a server that should have them shows none
vssadmin list shadows

# Audit for unauthorized remote access tools commonly abused by ransomware crews
$rmmTools = @("AnyDesk","ScreenConnect","TeamViewer","Splashtop","Atera","LogMeIn")
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match ($rmmTools -join '|') } |
  Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize

# Verify SMBv1 is disabled (legacy lateral movement vector)
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object FeatureName, State

# Check for recently created local admin accounts (persistence indicator)
Get-LocalGroupMember -Group "Administrators" | Select-Object Name, ObjectClass, PrincipalSource

Any unexpected RMM tool, any new local admin, or any server with zero shadow copies warrants an immediate triage conversation.

Remediation and Defensive Actions

Immediate (this week):

• MFA everywhere, no exceptions. Audit every internet-facing service — VPN, RDP gateways, webmail, RMM consoles — and confirm phishing-resistant MFA. The single most common root cause in healthcare ransomware IR is a remote access service with password-only auth.
• Test your backups against the actual threat. Backups must be immutable or offline (3-2-1 minimum), and — critically — backup service accounts must be separate from domain admin credentials. If one credential set can both encrypt production and delete backups, you don't have backups; you have a delay.
• Hunt before you're hit. Deploy the detections above. Ransomware crews dwell for days to weeks between access and detonation; the exfiltration phase is your intervention window.
• Review third-party and vendor access. Micro-hospital and outpatient operators depend heavily on external billing, scheduling, and IT vendors. Inventory every vendor with network access and confirm least privilege and monitoring.

Short term (30 days):

• Segment clinical from corporate. EHR systems, imaging, and medical devices should be unreachable from general user workstations. VLAN/ACL segmentation is what turns a ransomware incident into a contained incident.
• Deploy controlled folder access and attack surface reduction rules on endpoints holding PHI. ASR rules blocking Office child processes and credential theft from LSASS break multiple links in this kill chain.
• Tabletop the disclosure workflow. Nutex's SEC notification is a reminder that materiality determination, 8-K timing, OCR breach notification, and state AG requirements all run on parallel clocks. Your IR retainer and legal counsel should be in the loop before an incident, not during one.

If you suspect active compromise:

Isolate affected hosts at the switch/EDR level rather than powering off (preserves volatile evidence), force-reset domain admin and service account credentials from a known-clean system, and engage DFIR support before making containment decisions that could tip off the operator and trigger early detonation.

The Bottom Line

The Nutex Health incident follows a script we've seen executed against healthcare organizations of every size: get in quietly, steal everything worth extorting, then encrypt. The organizations that fare best aren't the ones with the biggest tool stack — they're the ones that detect the exfiltration phase, protect backups with credential isolation, and have rehearsed the regulatory response. Healthcare's threat actors aren't slowing down, and they're explicitly choosing victims who can't afford downtime. Make yourself a harder, noisier, faster-responding target than the next hospital operator on their list.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub