How to use this brief.

This brief is structured so a CISO can read the Executive Summary in five minutes and brief their executive team, then pass Sections 03–07 to their security team for immediate action. It is built from Protos AI investigation work using open-source threat intelligence, vendor reporting, and OSINT as of 14 May 2026.

The brief covers five things:

• —Executive summary — the key finding and what it means for your organisation today.
• —Confirmed 2026 incidents — real attacks, real clinical disruption, patient-safety impact.
• —Threat actors & access ecosystems — who is responsible and how they get in.
• —Indicators of compromise — defanged IOCs for immediate detection use.
• —Prioritised recommendations — immediate, short-term, and long-term mitigations.

The headline for non-technical stakeholders.

The core finding. Ransomware exposure in US healthcare is not being driven by any single dominant group. It is being driven by a shared criminal access ecosystem — infostealers, loaders, botnets, and brokered credentials — that compresses the path from initial compromise to operational shutdown. Fixing the downstream (ransomware brand) problem without fixing the upstream (access generation) problem is insufficient.

Why the access ecosystem framing matters

Traditional ransomware threat models focus on named brands: LockBit, ALPHV, Rhysida. In 2026, the more important model is upstream. A compromised vendor credential, harvested by an infostealer, sold to an access broker, and deployed by a loader, reaches your EHR before any ransomware brand enters the picture. Defending against the brand without defending against the supply chain that enables it leaves the primary attack path open.

This has direct implications for how healthcare organisations prioritise control investment: vendor MFA enforcement and credential hygiene are higher-leverage than signature-based ransomware detection alone.

2026 attacks with real clinical impact.

These are not near-misses. The 2026 incident corpus documents clinic shutdowns, chemotherapy cancellations, ambulance diversions, and data exposures affecting hundreds of thousands of patients.

Who is operating and how they get in.

Named ransomware brands remain relevant for attribution, but the more important threat model is the access supply chain that enables them.

Named actors — high confidence

The access ecosystem: how intrusions actually start

The dominant initial access vectors in 2026 healthcare ransomware are not novel. They are the same credential and supply-chain paths that have been exploited for years, still working because organisations have not closed them:

• —Infostealer-harvested credentials — malware like Redline, Vidar, and Lumma harvests credentials from employee devices, which are then sold on criminal markets and used for VPN, RDP, and EHR access.
• —Vendor and third-party compromise — attackers target MSPs, billing vendors, and SaaS providers to gain downstream access to multiple healthcare organisations from a single breach.
• —Phishing with healthcare lures — appointment notices, billing messages, prescription/lab-result notices, and vendor/MSP notifications. Healthcare context makes these lures highly credible.
• —Exposed remote access (VPN/RDP) — internet-facing remote access services without MFA remain a frequent entry point, particularly for initial credential spraying and brute force.
• —Supply-chain / GitHub Action compromise — the tdtqy C2 domain (see IOC section) was associated with a compromised GitHub Action supply-chain campaign, flagged by multiple vendors.

Defanged IOCs for detection use.

All indicators are defanged. Refang before use in detection systems. These are corroborated by multiple vendor sources as of 14 May 2026.

What to do now.

Actions are ordered by priority. The first three require immediate owner assignment. Subsequent items are short-term and strategic.

• —Require vendors and MSPs to demonstrate MFA, logging, and endpoint hygiene before or at next contract renewal. Apply least-privilege and just-in-time access models.
• —Increase network segmentation around clinical, IoMT, and EHR zones. Apply stricter remote-support controls. Limit lateral movement paths between IT and clinical networks.
• —Deploy detections for rapid lateral movement: credential use pattern anomalies and lateral RDP/SMB activity within 60 minutes of initial access. The ~29 minute breakout time demands early containment triggers.

• —Maintain a continuous vendor risk assessment programme with contractual security obligations and periodic attestation.
• —Expand telemetry to IoMT and XIoT assets. Integrate device monitoring into SOC workflows before a clinical device compromise occurs, not after.
• —Run quarterly tabletop exercises with clinical leadership focused on patient-safety outcomes — not just IT recovery. Include paper-based clinical fallback scenarios.

What your SOC should be watching.

• —Infostealer detection: abnormal archive or credential exfiltration patterns, spikes in outbound SMTP from user endpoints, and suspicious process spawning from user profile directories.
• —Vendor session monitoring: new vendor source IPs, geographically inconsistent login sessions, and high-volume data transfers from vendor service accounts.
• —C2 and exfil detection: outbound connections to newly-seen or low-reputation domains (particularly ICP blockchain domains like icp0[.]io), beaconing patterns, and outbound traffic to the IOCs listed in § 04.