ACSC Initiative: Successful takedown notifications – COVID-19 On 25 January 2021, an Australian government department reported an ongoing SMS phishing campaign targeting members of the public. The campaign employed a website link in the SMS message to direct recipients to a credential and PII-harvesting page that impersonated the department. The ACSC assisted the department in taking the page down. This incident highlights the ongoing exploitation by malicious actors to leverage local and global events, including of the coronavirus pandemic, to increase the likelihood of individuals clicking malicious links. The ACSC has enhanced its capability to respond at speed and scale to websites hosting malicious content. Since the commencement of the current takedown service in March 2021, the ACSC has removed more than 7,700 websites or services from the internet that were hosting malicious content related to the coronavirus pandemic. This is a significant increase compared to the same period in 2020. During this period, the ACSC was primarily focused on protecting the national vaccine supply, which resulted in more than 58 per cent of removals occurring within 24 hours of identification. During this period, 96.9 per cent of malicious web services detected were taken down. Case Study: Ransomware attacks disrupt critical Australian health services On 16 March 2021, the ACSC was informed of a ransomware incident affecting one of Melbourne’s larger metropolitan public health services. Some of the health service’s servers and workstations were infected with a Ryuk ransomware variant. This resulted in a partial IT system shutdown in the health service and the postponement of some elective surgeries. The incident was detected by an unauthorised change to group policies. Indicators of compromise led the health service ICT team to promptly cut internet connectivity and enact incident response. The Digital Health Incident Management Team at the Department of Health, Victoria, was promptly contacted by the health service and a coordinated cyber incident response commenced, engaging incident response resources within the Department, contracted incident response partners, Victorian government agencies and the ACSC. Prompt actions by the health service, the use of the advanced cybersecurity tools provided by the Department, and collaboration between the health service, government and contracted cyber security partners significantly reduced the impact of the ransomware attack and the restoration time. The health service reported that the attack did not compromise patient safety. However, the attack disrupted the delivery of critical health services for hospitals. The four hospitals run by the health service provide a range of emergency, surgical, medical and general healthcare services. These include maternity, palliative care, mental health, drug and alcohol, residential care, community health and state-wide specialist services. The health service implemented its business continuity plan. Offline backups were available. These were not affected by the ransomware attack, which helped to recover full capacity for patient care, even while IT systems were still impacted by the cyber incident. This incident demonstrates the continued targeting of the health sector by cybercriminals during the pandemic, and shows the need for organisations to have incident response plans in place and to make regular offline backups to increase their resilience in the event of a cyber security incident. 28