ResolverRAT: A New Cyber Threat Targeting Healthcare Providers

In the cybersecurity landscape healthcare providers have become prime targets for threat actors. The latest example of this trend is ResolverRAT, a remote access trojan (RAT) designed to infiltrate healthcare systems, exfiltrate sensitive patient data, and disrupt critical operations.  

What Is ResolverRAT? 

ResolverRAT is a new malware strain that grants attackers access to compromised systems. Once inside, the RAT can monitor user activity, steal credentials, and manipulate files. Its stealthy nature and advanced capabilities make it particularly dangerous for healthcare institutions. 

The malware spreads primarily through phishing emails that imitate legal threats or copyright violations. These emails are often written in different languages including Hindi, Turkish, and Portuguese, to increase their effectiveness in different regions. Recipients are tricked into downloading a legitimate file, which then injects ResolverRAT into memory using reflective DLL loading.  

Why Healthcare Providers Are at Risk

Healthcare organizations are being targeted due to the high value of medical data and the critical nature of their services. ResolverRAT has been observed targeting the healthcare and pharmaceutical sectors, with attacks detected starting around March 10, 2025. The malware executes entirely in memory and avoids writing to the disk which makes it difficult to detect using traditional security measures. A successful attack can lead to significant financial losses, legal repercussions, and, most concerningly, compromised patient care. 

ResolverRAT is part of a larger trend of cyber threats targeting the healthcare sector. Ransomware attacks have become all too common, with some strains designed not just to encrypt but to destroy data outright. These attacks can have devastating consequences, including the loss of critical patient information.  

Protecting Against ResolverRAT and Similar Threats

To protect against ResolverRAT and other cyber threats, healthcare providers should implement the following measures: 

• Regular Software Updates: Ensure all systems and applications are up to date.
• Employee Training: Educate staff on  how to recognize phishing attempts and other common attack vectors.  
• Network Segmentation: Divide networks into segments to prevent lateral movement of malware.  
• Robust Backup Strategies: Maintain regular, secure backups of data to allow fast recovery in case of an attack.  
• Incident Response Planning: Develop and regularly test a comprehensive incident response plan to ensure quick action when threats are detected.  

Conclusion 

The rise of ResolverRAT demonstrates the urgent need for healthcare providers to enhance their cybersecurity posture. If your company is concerned about your protection from cyber threats please visit our "Contact Us" page. Our vCISO service can bolster your company's cybersecurity posture efficiently and at a lower cost than a traditional CISO. By understanding the threats in this article and implementing the discussed security measures, organizations can better protect their systems, and ensure the continuity healthcare services.