WildPressure threatens ICS. WHO sustained an attack by DarkHotel. Ransomware gangs continue to hit medical targets.

As FireEye and others warn of the proliferation of commodity industrial control system attack tools, Kaspersky summarizes the activity of "WildPressure," a hitherto unknown advanced persistent threat active against industrial targets in the Middle East. Kaspersky doesn't attribute WildPressure to any nation-state, but it notes that the group distributes a C++ Trojan researchers call "Milum." It's unclear whether WildPressure's goals extend farther than espionage.

The World Health Organization has disclosed, Reuters reports, that it was subjected to cyberattack by the DarkHotel group. The attackers, who were after credentials, were detected "around" March 13th, and the WHO says the attack was unsuccessful. It's not clear whom DarkHotel works for, but they have a long record of cyber espionage, mostly against Russian and East Asian targets, but hitting many other countries as well.

Remember when the Maze, DoppelPaymer and Netwalker ransomware gangs told BleepingComputer that healthcare targets were off limits? The truth changes. L'Express says that CERT-FR reported that Paris hospitals sustained an inconvenient but unsuccessful ransomware attack Sunday. The strain used against the Parisian targets hasn't been specified, but in another case it has. Forbes reports that Hammersmith Medicines Research, a British firm standing by to help test any COVID-19 vaccines that may be developed, was the target of a Maze ransomware attack on March 14th. That's before Maze promised good behavior on March 18th, but on the other hand that good behavior doesn't extend to helping with decryption or relaxing extortion demands. The Maze gang has continued to demand payment.