SDBBot targeting health sector

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has observed increased targeting activity against the Australian health sector by actors using the SDBBot Remote Access Tool (RAT).

SDBBot is comprised of 3 components; an installer which establishes persistence, a loader which downloads additional components, and the RAT itself. Once installed, malicious actors will use SDBBot to move laterally within a network and exfiltrate data. SDBBot is a known precursor of the Clop ransomware.

While the recently observed activity is targeting the health sector, the ASD’s ACSC recommends that all network owners review their controls against ransomware as per ASD’s ACSC publication Ransomware in Australia.