Customer Security Newsletter - November 2026

Welcome to the November 2026 edition of the MEDITECH Customer Security Newsletter. This month, we provide critical updates on vulnerabilities added to federal catalogs and strategic intelligence on threat actors targeting essential infrastructure. Our goal is to provide you with actionable information and resources to strengthen your organization's security posture. This data has been gleaned from the review of public records on file with CISA, H-ISAC and Health Sector Cybersecurity Coordination Center (HC3) alerts. Please note the Talk To Us section, as we would like to tailor future editions of the newsletter to address specific concerns.

Known Exploited Vulnerabilities

Between October 5 and November 11, CISA added 46 items to its "Known Exploited Vulnerabilities" catalog based on definitive evidence of active exploitation in the wild.

Threat Actor Spotlight: RansomHub

First observed in early 2024, RansomHub (formerly known as Cyclops and Knight) has rapidly emerged as a prolific and disruptive Ransomware-as-a-Service (RaaS) operation targeting critical infrastructure, prominently including the Healthcare and Public Health (HPH) sector. Following law enforcement disruptions of older syndicates like LockBit and ALPHV/BlackCat, RansomHub established itself as an efficient operational haven, quickly attracting high-profile affiliates who aggressively target hospitals, clinics, and health systems.

• Initial Access and Exploitation: Affiliates compromise internet-facing systems and user endpoints primarily through spear-phishing campaigns, password spraying against breached credentials, and the rapid exploitation of known vulnerabilities in public-facing appliances such as Citrix ADC and F5 BIG-IP.
• Evasion and Lateral Movement: Once inside, the actors conduct internal network scanning using AngryIPScanner or Nmap and traverse systems via PsExec and Remote Desktop Protocol (RDP). To evade security defenses, affiliates deploy specialized tools to impair endpoint detection and response (EDR) agents, masquerade payloads under benign filenames such as Windows.exe, and delete volume shadow copies using vssadmin or WMI to inhibit recovery.
• Extortion and Defense: Operating under a double-extortion model, actors exfiltrate sensitive clinical and operational data using tools like WinSCP and Rclone before executing intermittent file encryption and depositing a ransom note titled How To Restore Your Files.txt. To defend against this syndicate, CISA and HHS urge healthcare entities to mandate phishing-resistant multi-factor authentication (MFA), patch public-facing appliances immediately, strictly restrict RDP, and maintain immutable offline backups.

News

Defending the Cold Chain: Feds Warn of Cyber Threats to Industrial Refrigeration

Multiple federal agencies have issued a joint alert urging critical infrastructure organizations to secure internet-accessible refrigeration controllers, warning that malicious actors could manipulate temperatures to destroy sensitive inventory or cause physical hazards.

Validating Clinical Recovery: Health-ISAC Stresses Post-Incident System and Data Verification

On October 7, 2026, H-ISAC added an article covering the after-action report from its 2026 Americas Hobby Exercise examining healthcare cyber resilience and disaster response. This piece emphasizes how bringing systems back online does not establish that clinicians can safely rely on them, urging health systems to rigorously validate restored clinical data, device workflows, and downtime records before declaring a return to normal operations.

Additional Resources

• HHS 405(d) Aligning Health Care Industry Security Approaches  - The 405(d) Program and Task Group is a collaborative effort between industry and the federal government, which aims to raise awareness, provide vetted cybersecurity practices, and move healthcare organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector. Their website provides the latest resources and information as well as an opportunity for involvement.
• Helpful resources CISA has provided can be found on the following pages:
  • Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure
  • StopRansomware.gov
  • Cyber Hygiene Services

Talk to us!

We at MEDITECH would love to hear your feedback about this newsletter, and we’d like to know what is on your mind. Is there something you would like us to address?

We also have a question for you that is important to us. What are your largest concerns or security hopes for 2026?

Please let us know by contacting us!

Until next time, stay alert out there!