BYOD Gang Claims Ransomware, Hospital and University Attacks in October

En bref

• BYOD gang made a ransomware claim in October.
• The group also claimed a hospital attack and university attacks.
• Michigan State University and University of New Mexico are named.
• Both campuses took action after a cyber incident.
• No CVE is tied to this activity.

In October, a threat actor known as BYOD gang publicly claimed a ransomware operation and also asserted involvement in a hospital attack and intrusions at universities. The cluster is notable because it links healthcare and higher-education targets in the same claimed activity. No CVE is associated with the matter, which means defenders are not looking at a single patchable software flaw; the priority is incident response and containment.

Michigan State University and the University of New Mexico are the named institutions. Each is responding to a cyber incident that led to action spanning the campus rather than a narrow departmental outage. The affected scale is a university campus, where identity systems, research networks, student services, and clinical or health-related functions can share dependencies.

The hospital reference raises the stakes. A ransomware claim against a care provider can disrupt clinical workflows and patient safety even when the technical scope is still unclear. University environments add complexity because they support open research collaboration, large user populations, and decentralized IT. Claims should be treated as unverified until the institutions confirm details, but they should not be dismissed while evidence is gathered.

What to watch: official statements from both universities, confirmation of whether data was accessed or encrypted, and any updates on the hospital claim. Security teams should watch for follow-on phishing, credential abuse, and lateral movement. Because no CVE is tied to the activity, controls such as multifactor authentication, network segmentation, offline backups, and rapid log review matter more than chasing a specific vulnerability.

À faire maintenant

1. Confirm the claim with the institutions' incident response leads and external partners before public messaging; preserve the original claim text and timestamps.
2. Segment and monitor clinical, research, and administrative networks; prioritize any shared identity or remote-access paths between them.
3. Force password resets and revoke active sessions for privileged and service accounts showing anomalous access; enforce MFA everywhere feasible.
4. Validate that backups are offline or immutable and test restoration for critical student, research, and health-related systems.
5. Hunt for ransomware precursors in logs—initial access, discovery, credential dumping, and lateral movement—and preserve evidence before rebuilding.
6. Brief campus health center and hospital liaison teams on downtime procedures and alternate communication if clinical systems are affected.
7. Issue a campus-wide advisory with reporting channels and warn users about phishing and credential theft tied to the claim.

Source originale

The Record