Hospitality Health ER Longview compromised by Genesis ransomware
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Genesis ransomware operators claim compromise of Hospitality Health ER in Longview; 394 users and 188 third-party credentials exposed.
Ransomware.live reports that Genesis ransomware operators have claimed responsibility for compromising Hospitality Health ER (Longview facility). The breach exposed credentials for 394 users and 188 third-party employees, along with 3 items of external attack surface reconnaissance. The incident demonstrates the ongoing targeting of healthcare facilities by ransomware operators, particularly those leveraging infostealer malware to obtain initial access credentials. This is a live incident posted to a ransomware leak site, indicating active exploitation and data exfiltration. Defenders in the healthcare sector should treat this as a signal of potential compromise attempts against their own environments, particularly those with similar attack surface exposure or shared service providers.
Mentioned in this report
Detection guidance
Packet Capture Tooling Executed on Windows Host
Detects built-in or common packet capture utilities (netsh trace, pktmon, tshark, dumpcap, windump, RawCap) started from the command line, which can be used to sniff credentials on the network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Packet Capture Tooling Executed on Windows Host
description: Detects network sniffing via netsh trace with capture enabled, pktmon
start, or dedicated capture binaries such as tshark, dumpcap, windump and RawCap.
Intended to catch credential sniffing by an intruder, not tied to any specific victim
or file name beyond the tool names.
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
category: process_creation
product: windows
detection:
selection_netsh:
Image|endswith: \netsh.exe
CommandLine|contains|all:
- trace
- start
- capture=yes
selection_pktmon:
Image|endswith: \pktmon.exe
CommandLine|contains: start
selection_tools:
Image|endswith:
- \tshark.exe
- \dumpcap.exe
- \windump.exe
- \rawcap.exe
condition: 1 of selection_*
falsepositives:
- Network or helpdesk engineers troubleshooting connectivity with netsh trace or Wireshark/tshark
- Authorised security assessments or monitoring agents that invoke dumpcap
level: medium
id: c984394a-0e1e-5daa-92a4-9073a535df08
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/SG9zcGl0YWxpdHkgSGVhbHRoIEVSIChMb25ndmlldylAZ2VuZXNpcw==
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/SG9zcGl0YWxpdHkgSGVhbHRoIEVSIChMb25ndmlldylAZ2VuZXNpcw==
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs