UNM Health Ransomware Attack: Surgery Cancellations and Ambulance Diversions — Detection and Hardening Guide for Healthcare Defenders

The University of New Mexico Health system is actively restoring systems after a cyber incident severe enough to force the cancellation of surgeries and the diversion of incoming ambulances. The incident has been claimed by a group identifying itself as BYOD, an encryption-based extortion operation. For defenders, this is the nightmare scenario materializing again in 2026: a ransomware event that crosses the line from IT outage to direct patient-safety impact.

I've led IR engagements against healthcare ransomware before, and the operational reality of this story should focus every CISO in the sector. When a Level I trauma center or academic medical center starts diverting ambulances, you're no longer talking about data loss — you're talking about stroke patients being routed elsewhere, surgical schedules collapsing, and clinicians reverting to paper workflows under pressure. The window between initial intrusion and encryption is your only opportunity to prevent this outcome. This post breaks down what the UNM Health incident tells us about the threat and, more importantly, what your SOC should be hunting for today.

Technical Analysis: The BYOD Extortion Model and the Healthcare Attack Chain

What We Know

• Victim: University of New Mexico Health — a major academic medical center and critical regional care provider
• Impact: Surgery cancellations, ambulance diversion, ongoing system restoration
• Claimed actor: BYOD, an encryption-based cybercrime group
• Status: Active incident response and recovery as of reporting

No CVE has been publicly tied to this intrusion, and I won't speculate on one. What matters operationally is the pattern, and it's one we've seen repeatedly against healthcare targets in 2025–2026: initial access (frequently via exposed remote access services, compromised credentials, or a phishing-delivered loader), followed by credential theft, lateral movement across the flat hospital network, exfiltration for double-extortion leverage, and finally mass encryption timed for maximum operational disruption.

Why Healthcare Remains the Softest High-Value Target

Hospital environments carry structural risk that attackers exploit deliberately:

1. Flat networks with legacy medical devices. Windows 7/XP-era imaging systems, unpatched IoT/OT devices, and clinical workstations that can't tolerate aggressive EDR policies create blind spots.
2. 24/7 operational dependency. Downtime procedures exist, but they degrade care within hours. Attackers know the pressure to pay is immense.
3. High-value data for extortion. PHI commands premium leverage in double-extortion schemes, and HIPAA breach notification obligations amplify reputational damage.
4. Under-resourced security teams. Many regional health systems run lean SOCs with limited 24/7 coverage — exactly when encryption is typically detonated (nights/weekends).

Exploitation Status

This is confirmed active exploitation in the wild — not theoretical. The BYOD group has claimed responsibility, and the operational impact (surgical cancellations, EMS diversion) is publicly documented. Whether this campaign is ultimately added to CISA KEV depends on whether a specific exploited vulnerability is disclosed; defenders should not wait for that to act.

The Observable Pre-Encryption Kill Chain

The encryption event itself is the last step. The detectable behaviors that precede it — and that your SOC must catch — include:

• Shadow copy and backup destruction (vssadmin delete shadows, wbadmin delete catalog, bcdedit recovery tampering)
• Mass file rename/encryption bursts on file shares and endpoints
• Ransom note creation (uniform .txt/.hta files dropped across directories)
• Abnormal administrative tool execution from unexpected hosts (PsExec-style lateral movement, wmic, PowerShell remoting at scale)
• Security tool tampering — attempts to stop or uninstall EDR/AV services before detonation

These are the behaviors the detections below target.

Detection & Response

The following detections focus on the highest-fidelity pre-encryption behaviors. They are tuned to minimize noise — shadow copy deletion and backup catalog destruction are almost never legitimate on endpoints and clinical workstations.

---
title: Shadow Copy Deletion via vssadmin or wmic
description: Detects deletion of volume shadow copies — a hallmark ransomware pre-encryption behavior observed in healthcare ransomware incidents including the UNM Health attack pattern.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
id: 3f2a9c41-7b8d-4e21-a6c5-9d1e2f3a4b5c
status: experimental
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\vss.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  condition: selection_img and selection_cmd
falsepositives:
  - Rare legitimate storage administration; verify against change tickets
level: critical
---
title: Backup Catalog and Boot Recovery Tampering
description: Detects destruction of Windows backup catalogs and disabling of boot recovery options — ransomware anti-recovery behavior consistent with encryption-based extortion groups such as BYOD.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
id: 8b1d4e72-3c5f-4a19-b2d7-6e8f9a0b1c2d
status: experimental
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wbadmin.exe'
      - '\bcdedit.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Disaster recovery testing (scheduled and documented)
level: critical
---
title: Mass Ransom Note File Creation
description: Detects burst creation of identical ransom note files across directories — a high-confidence indicator of active encryption consistent with extortion group operations.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
id: 5c7e2f94-1a3b-4d68-9e21-8f0a2b3c4d5e
status: experimental
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'readme_for_decrypt'
      - 'how_to_decrypt'
      - 'recover_your_files'
      - 'restore_files'
      - 'decrypt_instructions'
    TargetFilename|endswith:
      - '.txt'
      - '.hta'
      - '.html'
falsepositives:
  - Security awareness simulations; red team exercises
level: high

// Hunt for anti-recovery behaviors (shadow copy/backup deletion) across endpoints
// Run as a 24h lookback; any hit on a clinical endpoint warrants immediate escalation
let timeframe = 24h;
DeviceProcessEvents
| where TimeGenerated > ago(timeframe)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "wbadmin.exe", "bcdedit.exe")
| where ProcessCommandLine has_any (
    "delete shadows",
    "shadowcopy delete",
    "resize shadowstorage",
    "delete catalog",
    "recoveryenabled no",
    "bootstatuspolicy ignoreallfailures"
)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Correlate with mass file rename/encryption bursts on file servers and shares
DeviceFileEvents
| where TimeGenerated > ago(timeframe)
| where ActionType == "FileRenamed"
| summarize RenameCount = count(), DistinctExtensions = dcount(tostring(split(FileName, ".")[-1])) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 5m)
| where RenameCount > 200
| order by RenameCount desc;

-- Hunt for ransom notes and pre-encryption anti-recovery artifacts
-- Deploy across clinical workstations and file servers during a suspected ransomware event

-- Part 1: Locate ransom-note-style files created in the last 72 hours
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:\\Users\\**\\*readme*decrypt*.txt',
          accessor='ntfs')
WHERE Btime > now() - 259200
UNION
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:\\**\\how_to_decrypt*',
          accessor='ntfs')
WHERE Btime > now() - 259200

-- Part 2: Identify processes with anti-recovery command lines still running
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|delete catalog|recoveryenabled no)'

# UNM Health-pattern ransomware readiness verification (run on critical endpoints/servers)
# Verifies recovery posture and flags common pre-encryption weaknesses

# 1) Confirm shadow copies exist and VSS is operational
Write-Host "=== Volume Shadow Copy Status ===" -ForegroundColor Cyan
vssadmin list shadows
Get-Service VSS | Select-Object Name, Status, StartType

# 2) Confirm Windows Backup catalog integrity on servers
Write-Host "`n=== Backup Catalog Versions ===" -ForegroundColor Cyan
wbadmin get versions 2>$null

# 3) Audit for suspicious recent ransom-note-like files (last 72h)
Write-Host "`n=== Suspicious Note Files (72h) ===" -ForegroundColor Cyan
Get-ChildItem -Path C:\ -Recurse -Include "*decrypt*","*readme*recover*","*restore*files*" `
  -ErrorAction SilentlyContinue | Where-Object { $_.CreationTime -gt (Get-Date).AddHours(-72) } |
  Select-Object FullName, CreationTime | Format-Table -AutoSize

# 4) Verify EDR/Defender tamper protection and real-time monitoring state
Write-Host "`n=== Defender Status ===" -ForegroundColor Cyan
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, `
  IsTamperProtected, AntivirusSignatureLastUpdated

# 5) Confirm SMBv1 is disabled (legacy lateral movement vector in hospital environments)
Write-Host "`n=== SMBv1 State ===" -ForegroundColor Cyan
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

# 6) List admin shares accessed recently (lateral movement indicator)
Write-Host "`n=== Open SMB Sessions ===" -ForegroundColor Cyan
Get-SmbSession | Select-Object ClientComputerName, NumOpens, SessionId | Format-Table -AutoSize

Remediation: What Healthcare Defenders Must Do Now

Immediate (24–48 hours)

1. Deploy the shadow-copy/backup-destruction detections above across every clinical endpoint and file server. These are near-zero-false-positive rules. Any hit means you're likely already inside an active intrusion — treat it as a potential IR trigger, not a ticket.
2. Verify backup integrity and isolation. Confirm backups are offline, immutable (object lock/WORM), or air-gapped, and that backup infrastructure credentials are segregated from domain credentials. BYOD-style groups target backups before detonation. Test an actual restore of one critical system this week — EHR, PACS, or the patient portal.
3. Audit internet-facing remote access. Enumerate every VPN concentrator, RDP gateway, and vendor remote-support path into the clinical network. Enforce phishing-resistant MFA on all of them. Disable any account that hasn't authenticated in 90 days.
4. Segment clinical from corporate IT. At minimum, ACL off medical device VLANs, restrict SMB/RPC between workstation subnets, and block workstation-to-workstation lateral movement. Ambulance diversion happens because everything goes down together — segmentation is what keeps that from being your outcome.

Short-Term (30 days)

5. Tabletop the downtime procedures with clinical leadership. The UNM Health incident proves paper workflows and diversion protocols are now core security controls. Run a joint IT/clinical exercise simulating EHR loss during a trauma surge.
6. Harden EDR coverage on legacy clinical systems. Where agents can't be installed (older imaging modalities, lab instruments), compensate with network detection: monitor those VLANs for any outbound connection or unexpected SMB initiation.
7. Review cyber insurance and IR retainer readiness. Know your retainer activation path before 2 a.m. on a Saturday. Confirm your IR firm can be on-site (or remote-hands) within contractual SLAs.

Strategic

8. Track healthcare-targeting extortion groups as a standing threat-hunt hypothesis. Groups like BYOD recycle TTPs across victims. Subscribe to CISA's #StopRansomware guidance and HHS HC3 sector alerts, and fold new indicators into your detection engineering sprint cycle — not into a spreadsheet nobody reads.
9. Measure mean-time-to-contain, not just detect. In healthcare, the metric that matters is whether you can isolate a subnet and preserve clinical operations within minutes of a confirmed encryption pre-stage alert.

The UNM Health incident is not an anomaly — it's the current baseline for healthcare ransomware in 2026. The organizations that avoid becoming the next headline are the ones hunting for anti-recovery behavior today, not the ones waiting for attribution.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub