UNM Health Cyberattack: Hospital Diverts Patients, 30+ Clinics Closed — A Defender's Playbook for Healthcare Ransomware Resilience

When a cybersecurity incident forces a Level I trauma center to turn away ambulances and cancel appointments across more than 30 clinics, the conversation stops being theoretical. That is exactly what happened at the University of New Mexico Health System in Albuquerque, which instructed patients not to present at its main hospital and diverted inbound patients while it worked to contain and recover from a cybersecurity issue. As reported by SecurityWeek, UNM Health took the extraordinary step of closing clinic operations — a decision no health system makes unless core clinical or supporting IT systems are untrustworthy or unavailable.

This post is written for the defenders: the SOC analysts, IR leads, biomedical engineers, and CISOs who carry the pager when a hospital goes down. We will break down what an incident of this magnitude tells us about attacker tradecraft against healthcare, and — more importantly — deliver the detection content and hardening steps you need before your organization becomes the next headline.

Introduction: Why Patient Diversion Is the Ultimate Severity Signal

Hospitals do not divert patients lightly. Diversion means ambulances rerouted to other facilities, delayed emergency care, postponed surgeries, and a direct, measurable impact on patient safety. When a health system like UNM Health — the state's only Level I trauma center and a critical safety-net provider for New Mexico — tells the public to stay away from its main hospital and cancels appointments at 30+ clinics, it signals one of two conditions:

1. Core clinical systems are unavailable — the EHR, PACS imaging, laboratory information systems, pharmacy dispensing, or nurse call/telemetry integrations are down, or
2. The integrity of the environment cannot be trusted — responders have not yet bounded the intrusion, and keeping systems online risks wider compromise or data destruction.

In most incidents of this profile, both are true simultaneously. Healthcare remains the most-targeted critical infrastructure sector for ransomware and extortion actors precisely because downtime intolerance is extreme. Adversaries know that a hospital under pressure to restore clinical operations is a hospital under pressure to pay. Groups that have historically hit healthcare delivery organizations routinely combine encryption with data theft (double extortion), and they time detonation for nights and weekends when clinical and IT staffing is thinnest.

The defensive lesson from UNM Health is blunt: your detection and containment capability must operate at machine speed, because the blast radius of healthcare ransomware is measured in diverted ambulances, not lost files.

Technical Analysis: How Hospital-Taking Incidents Typically Unfold

While UNM Health has not publicly attributed the incident or released technical indicators at the time of writing, incidents that produce this operational signature — enterprise-wide diversion plus mass clinic closure — overwhelmingly follow a recognizable attack chain. Defenders should assume and hunt for the following pattern, which mirrors the tradecraft documented across major healthcare ransomware events:

Initial access. Phishing with credential harvesting, exploitation of internet-facing remote access (VPN concentrators, RDP gateways, Citrix/VDI infrastructure), or access purchased from an initial access broker. Healthcare's sprawling third-party connectivity — revenue cycle vendors, transcription services, medical device management platforms — expands this surface considerably.

Persistence and privilege escalation. Valid domain accounts (often compromised service accounts with excessive privilege), followed by deployment of remote management tooling masquerading as legitimate IT software, and credential theft from memory on key servers.

Discovery and staging. Enumeration of domain controllers, backup infrastructure (Veeam, Commvault, Dell EMC), virtualization management planes (vCenter/ESXi), and — critically in healthcare — interface engines and EHR database hosts. Attackers who understand healthcare target the systems clinicians cannot work without.

Defense evasion and impact. Before detonation, operators typically:

• Delete Volume Shadow Copies (vssadmin delete shadows, wmic shadowcopy delete, bcdedit recovery disabling)
• Stop or disable backup agents, EDR services, and database services
• Disable Windows Recovery Environment
• Push encryption payloads domain-wide via Group Policy, PsExec, or the organization's own software distribution platform (SCCM/MECM abuse is common)

Extortion. Data staged for exfiltration to attacker-controlled cloud storage or bulletproof hosting before encryption, enabling leak-site pressure even if backups are clean.

The UNM Health scenario — sudden, broad operational shutdown across inpatient and outpatient facilities — is consistent with either active encryption impact or a precautionary enterprise shutdown executed by IR teams to bound an intrusion in progress. Both demand the same defensive posture: detect the pre-detonation behaviors, because post-detonation detection is too late.

Detection & Response

The detections below target the highest-fidelity pre-encryption behaviors. These are the signals that give you hours — sometimes minutes — to isolate before clinical impact.

Sigma Rules

---
title: Shadow Copy Deletion via Vssadmin or WMIC
description: Detects deletion of volume shadow copies, a near-universal precursor to ransomware detonation. In healthcare environments this should page immediately — there are virtually no legitimate mass-deletion workflows.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/14
id: 9f2c7a1e-3b45-4c8d-a1e6-5f7d8c9b2a31
status: experimental
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  condition: selection_img and selection_cli
falsepositives:
  - Rare storage administration; any hit in a healthcare environment warrants immediate triage
level: critical
---
title: Windows Recovery Environment Disabled via Bcdedit or ReAgentC
description: Detects tampering with boot recovery configuration and Windows Recovery Environment, commonly executed by ransomware operators immediately before encryption to prevent rollback.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/14
id: 4d8e2f6a-1c93-4b7e-9a2d-6e3f5b8c1d42
status: experimental
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_reagentc:
    Image|endswith: '\reagentc.exe'
    CommandLine|contains:
      - '/disable'
  condition: 1 of selection_*
falsepositives:
  - Golden image preparation; OS deployment tooling (MDT/SCCM task sequences)
level: high
---
title: Mass Service Stop Targeting Backup, Database, or Security Services
description: Detects net.exe or sc.exe used to stop backup agents, database engines, or security services — a standard ransomware pre-detonation step to unlock files and blind defenders.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/02/14
id: 7b3a9d2c-5e61-4f8a-b3c7-2d9e4a6f8b15
status: experimental
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
  selection_cli:
    CommandLine|contains:
      - 'stop'
  selection_target:
    CommandLine|contains:
      - 'veeam'
      - 'backup'
      - 'mssql'
      - 'sqlserver'
      - 'oracle'
      - 'defender'
      - 'sophos'
      - 'sentinel'
      - 'crowdstrike'
  condition: selection_tool and selection_cli and selection_target
falsepositives:
  - Maintenance windows executed by service accounts; baseline your DBA and backup admin accounts and suppress them
level: high

KQL (Microsoft Sentinel / Defender)

This hunt query correlates multiple pre-encryption behaviors on a single host within a short window — the temporal clustering is what separates an intrusion from routine administration. Run it across your clinical server estate and interface engine hosts first.

let window = 15m;
let preEncryptionCmds = dynamic(["vssadmin", "shadowcopy delete", "bcdedit", "reagentc", "wbadmin delete"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ProcessCommandLine has_any (preEncryptionCmds)
    or (FileName in~ ("net.exe", "net1.exe", "sc.exe") and ProcessCommandLine has "stop" and ProcessCommandLine has_any ("backup", "veeam", "mssql", "defender"))
| summarize BehaviorCount = dcount(ProcessCommandLine),
            Commands = make_set(ProcessCommandLine, 20),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, window)
| where BehaviorCount >= 2
| project DeviceName, InitiatingProcessAccountName, FirstSeen, LastSeen, BehaviorCount, Commands
| order by FirstSeen desc;

A complementary identity-side hunt: ransomware operators frequently authenticate to backup consoles and virtualization management planes before detonation. Watch for off-hours logons to vCenter, backup servers, and EHR database hosts from accounts that do not normally touch them:

SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624 and LogonType in (3, 10)
| where Computer has_any ("veeam", "backup", "vcenter", "esxi") or Computer has "sql"
| summarize LogonCount = count(), SourceIPs = make_set(IpAddress, 10)
    by Account, Computer, bin(TimeGenerated, 1h)
| where LogonCount > 5
| order by LogonCount desc;

Tune the has_any computer name list to your actual backup, virtualization, and database host naming convention. Off-hours success events on these assets from service desk or vendor accounts are your highest-value leads.

Velociraptor VQL

For post-alert triage or proactive hunting, this artifact enumerates running processes for encryption-adjacent tooling and checks shadow copy state — fast to deploy across a hospital fleet during a threat hunt:

-- Hunt for pre-encryption tooling and shadow copy tampering indicators
LET proc_hunt = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(vssadmin.*delete|shadowcopy.*delete|bcdedit.*recoveryenabled|reagentc.*/disable|wbadmin.*delete|net.*stop.*(veeam|backup|mssql|defender))'
   OR Name =~ '(?i)(vssadmin|bcdedit|reagentc|wbadmin)\.exe'

SELECT * FROM proc_hunt

-- Enumerate persistence via services for recently modified binary paths (staging check)
SELECT Name, DisplayName, PathName, StartName, State
FROM services()
WHERE PathName =~ '(?i)(\\users\\public|\\programdata|\\windows\\temp|appdata\\local\\temp)'
   OR PathName =~ '(?i)(psexec|paexec|remcom|csexec)'

The second artifact catches a staging pattern that is nearly diagnostic in ransomware cases: service binaries executing from user-writable staging directories or named-pipe service names characteristic of PsExec-style lateral movement.

Remediation and Hardening Script

The following PowerShell validates your defensive posture on critical Windows servers (backup, EHR database, interface engines) and re-arms the exact recovery mechanisms ransomware operators disable. Run it via your RMM or as a scheduled hardening check:

#Requires -RunAsAdministrator
# Security Arsenal - Healthcare Ransomware Resilience Check
# Run on critical servers: backup infrastructure, EHR DB hosts, interface engines

$report = @()

# 1. Verify Volume Shadow Copies exist and VSS is functional
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report += [pscustomobject]@{ Check = 'Shadow Copies Present'; Status = if ($shadows) { "PASS ($($shadows.Count) found)" } else { 'FAIL - none found' } }

# 2. Verify Windows Recovery Environment is enabled
$reagentc = (reagentc /info 2>&1) -join ' '
$report += [pscustomobject]@{ Check = 'WinRE Enabled'; Status = if ($reagentc -match 'Enabled') { 'PASS' } else { 'FAIL - re-enable with: reagentc /enable' } }

# 3. Verify boot recovery settings have not been tampered with
$bcd = (bcdedit /enum {current} 2>&1) -join ' '
$recoveryEnabled = $bcd -match 'recoveryenabled\s+Yes'
$report += [pscustomobject]@{ Check = 'Boot Recovery Enabled'; Status = if ($recoveryEnabled) { 'PASS' } else { 'FAIL - run: bcdedit /set {current} recoveryenabled yes' } }

# 4. Enable Controlled Folder Access (Defender anti-ransomware) if applicable
$cfa = Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess
$report += [pscustomobject]@{ Check = 'Controlled Folder Access'; Status = if ($cfa -eq 1) { 'PASS' } else { 'WARN - consider enabling: Set-MpPreference -EnableControlledFolderAccess Enabled' } }

# 5. Confirm backup service is running and protected
$backupSvc = Get-Service | Where-Object { $_.DisplayName -match 'Veeam|Backup|Commvault' } | Select-Object -First 1
$report += [pscustomobject]@{ Check = 'Backup Service Running'; Status = if ($backupSvc -and $backupSvc.Status -eq 'Running') { "PASS ($($backupSvc.DisplayName))" } else { 'FAIL - investigate immediately' } }

# 6. Audit for service binaries in high-risk staging paths
$suspicious = Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'Users\\Public|ProgramData|Windows\\Temp|AppData\\Local\\Temp' }
$report += [pscustomobject]@{ Check = 'No Staging-Path Services'; Status = if ($suspicious) { "FAIL - review: $($suspicious.Name -join ', ')" } else { 'PASS' } }

$report | Format-Table -AutoSize

# Remediate the two most commonly disabled recovery mechanisms (uncomment to auto-fix):
# reagentc /enable
# bcdedit /set {current} recoveryenabled yes
# bcdedit /set {current} bootstatuspolicy displayallfailures

Remediation: The Healthcare-Specific Action Plan

Whether you are responding to an active event or hardening against the next one, these are the steps that determine whether your hospital diverts patients or absorbs the blow:

Immediate (this week):

1. Verify backup integrity and isolation. Test an actual restore of your EHR database and one clinical application — not a backup job status, a restore. Confirm backups are immutable (object lock, air-gapped copy, or hardened repository). If your backup console is domain-joined with the same credentials attackers can steal, assume it is already targeted.
2. Deploy the detections above against backup servers, hypervisor management, database hosts, and interface engines first. These are the detonation choke points.
3. Audit privileged access to clinical systems. Remove standing domain admin rights from EHR and interface engine service accounts. Attackers escalate through over-privileged service accounts in nearly every healthcare incident.
4. Exercise your downtime procedures. UNM Health's situation is the test case: can your clinicians operate on paper/downtime forms for 72 hours? Do registrars know the downtime admission workflow? Is there a printed, current phone tree that does not depend on the network?

Near-term (30 days):

5. Segment clinical from corporate. VLAN/ACL separation between biomedical devices, clinical applications, and general IT. Flat networks are why a compromised workstation becomes a diverted trauma center.
6. MFA everywhere remote, including vendor access pathways. Third-party support connections into healthcare networks are a proven initial access vector — enforce named accounts, MFA, and just-in-time access for every vendor session.
7. EDR with isolation capability on servers, not just endpoints. When the pre-encryption Sigma rules fire, your response action is host isolation within minutes. Test that your EDR can isolate a server without taking the EHR down with it — know which dependencies break.
8. Tabletop the diversion decision. Who has authority to declare diversion? What is the clinical trigger criteria? Document it now, because making that call at 3 a.m. mid-incident without a framework is how response stalls.

Structural (90 days):

9. Align to HHS 405(d) HICP practices and the HIPAA Security Rule's contingency planning requirements (45 CFR § 164.308(a)(7)) — a tested contingency plan is not just compliance, it is the difference between a headline and a footnote.
10. Monitor threat actor leak sites and healthcare-focused threat intel for your organization's data. Double extortion means the incident is not over when systems are restored.

Conclusion

The UNM Health incident is not an anomaly — it is the current baseline of healthcare threat reality in 2026. Adversaries have learned that the fastest route to a ransom payment runs through patient care, and they will keep taking hospitals offline until the economics stop working. The defenders' counter is unglamorous but decisive: detect the pre-detonation behaviors (shadow copy deletion, recovery tampering, backup service stops), isolate at machine speed, maintain immutable tested backups, and rehearse clinical downtime until it is muscle memory. Every hour of detection lead time is an ambulance that never gets diverted.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub