Ransomware Attacks on Windward Life Care and Legend Senior Care: Analysis and Defense

Introduction

Two senior care providers, Windward Life Care (California) and Legend Senior Care, have recently confirmed suffering encryption-based cyber incidents. While specific technical details regarding the malware strain are still emerging, the impact on Protected Health Information (PHI) and operational continuity is evident. For defenders, this reinforces the harsh reality that the healthcare sector remains a prime target for ransomware operations due to the high value of patient data and the critical need for uptime. We must assume that threat actors are actively scanning for vulnerabilities in senior care infrastructure, particularly legacy remote access solutions and unpatched ERP systems.

Technical Analysis

Based on the incident disclosures and current trends in healthcare-targeted ransomware, we assess the attack profile as follows:

Threat Vector: While the initial access vector for these specific incidents has not been publicly disclosed, common vectors in this sector include compromised Remote Desktop Protocol (RDP) credentials, phishing emails delivering malicious payloads, or exploitation of unpatched VPN appliances (e.g., Fortinet, Pulse Secure).
Attack Mechanics (Encryption): The attackers deploy an encryption payload designed to lock critical files, including databases containing patient records and administrative documents. In modern ransomware attacks, this is almost always accompanied by data exfiltration (double extortion), where threat actors steal PHI before encrypting the systems to leverage ransom payment under the threat of public release.
Affected Systems: Windows-based environments hosting Electronic Health Records (EHR), billing systems, and file servers are the primary targets.
Exploitation Status: The "encryption-based" terminology confirms active ransomware deployment. This is not a theoretical vulnerability; it is an active exploitation scenario impacting live production environments.

Detection & Response

To detect active ransomware behavior similar to that observed in these incidents, security teams must monitor for the precursors to encryption—specifically the deletion of Volume Shadow Copies (VSS) and mass file modifications.

Sigma Rules

YAML

---
title: Potential Ransomware Activity - VSS Shadow Copy Deletion via VssAdmin
id: 8c2aa663-1b83-4b60-8760-b30c7ff2f1d5
status: experimental
description: Detects attempts to delete Volume Shadow Copies using vssadmin.exe, a common tactic used by ransomware to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2025/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
falsepositives:
  - System administrators performing backup maintenance
level: high
---
title: Potential Ransomware Activity - Mass Encryption via PowerShell
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the use of PowerShell to encrypt files using the .NET Framework, a technique used by file-encrypting ransomware.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2025/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'System.Security.Cryptography.AesManaged'
      - 'System.Security.Cryptography.RijndaelManaged'
      - 'TransformFinalBlock'
  condition: selection
falsepositives:
  - Legitimate backup scripts or custom admin tools
level: medium

KQL (Microsoft Sentinel / Defender)

The following KQL query hunts for rapid file creation events with suspicious extensions (common in ransomware) and the deletion of shadow copies in a short timeframe.

KQL — Microsoft Sentinel / Defender

// Hunt for Mass File Encryption and Shadow Copy Deletion
let TimeFrame = 1h;
let FileEncryptionEvents =
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where ActionType == "FileCreated"
    | where FileName has_any (".locked", ".enc", ".crypt", ". ransomware")
    | summarize count() by DeviceName, bin(Timestamp, 5m)
    | where count_ > 50; // Threshold for mass encryption
let ShadowCopyDeletion =
    DeviceProcessEvents
    | where Timestamp > ago(TimeFrame)
    | where ProcessCommandLine has "delete shadows"
    | where FileName =~ "vssadmin.exe" or FileName =~ "wmic.exe";
FileEncryptionEvents
| join kind=inner (ShadowCopyDeletion) on DeviceName
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath

Velociraptor VQL

This Velociraptor artifact hunts for the execution of known ransomware precursor binaries (vssadmin, wmic, bcdedit) used to disable recovery and safe modes.

VQL — Velociraptor

-- Hunt for Ransomware Precursors and Recovery Disabling Commands
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name IN ('vssadmin.exe', 'wmic.exe', 'bcdedit.exe', 'wbadmin.exe')
  AND (
    CommandLine =~ 'delete' OR
    CommandLine =~ 'shadowcopy' OR
    CommandLine =~ 'recoveryenabled' OR
    CommandLine =~ 'delete catalog'
  )

Remediation Script (PowerShell)

Use this PowerShell script to audit common ransomware entry points and recovery configurations on Windows endpoints within your healthcare environment.

PowerShell

# Ransomware Hardening Audit Script for Healthcare Endpoints
Write-Host "[+] Starting Ransomware Hardening Audit..." -ForegroundColor Cyan

# 1. Check RDP Status (Ensure it is disabled if not required)
$RDPStatus = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
if ($RDPStatus -eq 0) {
    Write-Host "[WARNING] RDP is ENABLED. Consider disabling via Group Policy if not required." -ForegroundColor Red
} else {
    Write-Host "[PASS] RDP is Disabled." -ForegroundColor Green
}

# 2. Check for SMBv1 (Legacy Protocol often exploited)
$SMB1 = Get-WindowsFeature -Name FS-SMB1
if ($SMB1.Installed) {
    Write-Host "[WARNING] SMBv1 is installed. Recommend immediate removal." -ForegroundColor Red
} else {
    Write-Host "[PASS] SMBv1 is not installed." -ForegroundColor Green
}

# 3. Audit VSS Service Status (Ensure it is running for backups)
$VSSService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($VSSService.Status -ne 'Running') {
    Write-Host "[WARNING] Volume Shadow Copy Service is not running. Backups may fail." -ForegroundColor Red
} else {
    Write-Host "[PASS] Volume Shadow Copy Service is running." -ForegroundColor Green
}

# 4. Check for recent unusual modifications to common ransomware extensions (Basic check)
Write-Host "[INFO] Checking for recent '.locked' or '.encrypted' files in user directories..."
$SuspiciousFiles = Get-ChildItem -Path C:\Users\ -Recurse -ErrorAction SilentlyContinue -Include "*.locked","*.encrypted" | 
                    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) }
if ($SuspiciousFiles) {
    Write-Host "[CRITICAL] Found recently encrypted files!" -ForegroundColor Red
    $SuspiciousFiles | Select-Object FullName, LastWriteTime
} else {
    Write-Host "[PASS] No suspicious encrypted files found in the last 24 hours." -ForegroundColor Green
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan

Remediation

Immediate action is required to prevent similar outcomes:

Isolate Affected Systems: If encryption is detected, immediately disconnect the host from the network (Ethernet and Wi-Fi) to prevent lateral movement.
Review Remote Access: Audit all RDP and VPN logs for failed login attempts or successful logins from anomalous geo-locations. Enforce MFA immediately on all remote access gateways.
Patch Management: Prioritize patching of critical vulnerabilities in external-facing infrastructure (VPN concentrators, firewalls, RDP gateways).
Offline Backups: Ensure that backups are immutable and offline. Test the restoration process regularly to verify data integrity in the event of a ransomware scenario.
Network Segmentation: Segregate IoT and medical devices from the administrative network. Senior care facilities often have interconnected systems; segmentation limits the blast radius.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub