Skip to main content

Cyberattacks on Big Pharma and Its Ecosystem: Threat Actors, Attack Surfaces, TTPs, and Defensible Lessons

An evidence-based guide to attacks on pharmaceutical manufacturers and the research, regulatory, distribution, medtech, and health infrastructure around them

Cyberattacks on Big Pharma and Its Ecosystem — 1200km cover featuring a medicine vial, DNA helix, hooded figure, research facility, and connected globe.

Cyberattacks on pharmaceutical organizations are often described as a single, escalating crisis. The reality is more complicated. A destructive state operation can disrupt a drug manufacturer without having targeted that company. An intelligence service can pursue vaccine research without encrypting a single system. A criminal group can exploit one internet-facing file-transfer product across hundreds of organizations. An attacker can also compromise a regulator, contract research organization, distributor, or patient-support provider and obtain pharmaceutical data without breaching a drugmaker directly.

Those distinctions matter. They change which controls are useful, which threat actors are plausible, how an incident should be investigated, and what can responsibly be claimed about attribution. They also expose a recurring analytical failure: public reporting often combines confirmed victim disclosures, government attribution, vendor assessments, and criminals' leak-site claims as though they were equally reliable.

This research reconstructs the landscape from primary records wherever possible: securities filings, company notices, regulator statements, government advisories, indictments, and MITRE ATT&CK. Reputable secondary reporting is used only when it adds information that the primary record does not provide, and the text labels allegations and assessments as such.

Scope and evidence boundary — 25 September 2026. “Big Pharma” has no formal cyber-risk boundary. This article covers large drug manufacturers and the ecosystem that holds their data or supports their operations: regulators, contract research organizations (CROs), distributors, patient-support providers, managed file-transfer systems, and selected medtech companies. The incident set is illustrative, not a complete census. “Confirmed” means supported by a victim, regulator, court, or government record; “assessed” means a named government or security provider made the judgment; “claimed” means an attacker or leak site asserted it. Absence of public evidence is not evidence that an event did not occur.

Download the integrated Markdown · Image provenance and hashes · Original cover. Web-optimized display images retain the supplied artwork; each infographic links to its unchanged PNG original.

Publication: 26 September 2026; evidence cutoff: 25 September 2026. Internal links connect this article to the Threat Matrix, ATT&CK Knowledge Mesh, and practical field guides. These are learning and investigation routes; they do not add attribution evidence.

Table of Contents​

What the evidence actually shows​

The most defensible public-sector dataset is broader than pharmaceuticals. ENISA reviewed 215 publicly reported health-sector incidents affecting the EU and neighboring countries between January 2021 and March 2023. Healthcare providers represented 53% of that sample, public health authorities 14%, and pharmaceutical organizations 9%. Ransomware accounted for 54% of the incidents, while 43% of the ransomware incidents also involved a data breach or theft. Supply-chain or service-provider compromise accounted for 7% of the sample. ENISA explicitly derived the dataset from public reporting, so it should not be treated as a complete population or as a pharma-only ransomware rate. Its current health-sector overview reports that ransomware made up 45% and data breaches 28% of the health-related incidents it analyzed in 2024. (ENISA, Health Threat Landscape; ENISA health-sector overview)

The incident record supports five conclusions.

  1. Pharmaceutical risk extends beyond the manufacturer. EMA held Pfizer/BioNTech regulatory material; Cencora and its subsidiary held patient-support data; MOVEit exposed how a shared transfer product can become the intrusion point; and the IBM cold-chain campaign impersonated a specialized refrigeration supplier. (EMA; Cencora Form 8-K; CISA MOVEit advisory; IBM X-Force)
  2. The same sector attracts different motives. Intelligence services seek research, policy, or strategic advantage. Criminals seek payment through theft, encryption, and disclosure pressure. Destructive state activity may hit a pharmaceutical company as collateral damage. An insider or security professional can misuse legitimate expertise and access.
  3. Operational impact does not require an OT-specific exploit. Merck's NotPetya losses followed enterprise-wide propagation. Sun Pharma said a ransomware incident affected business operations. Inotiv used offline alternatives after portions of its environment were encrypted. Stryker said disruption to its global Microsoft environment reached order processing, manufacturing, and shipping, while it did not believe patient-related services or connected products were affected. Identity, Windows administration, and shared enterprise services can therefore become pathways to manufacturing or research interruption without a publicly documented PLC exploit. (Merck 2017 Form 10-K; Sun Pharma update; Inotiv Form 8-K; Stryker 12 March Form 8-K)
  4. Public attribution is the exception, not the default. Governments attributed NotPetya to Russia's GRU and described APT29 vaccine targeting. EMA, Cencora, Sun Pharma, and Novo Nordisk did not publicly identify an attacker in their principal notices. Criminal claims may guide investigation, but they are not equivalent to forensic or legal proof.
  5. The public record is asymmetric. Companies often disclose business effects and categories of affected data but not initial access, lateral movement, detection logic, or containment detail. A responsible ATT&CK mapping must leave those cells blank rather than inventing a complete chain.

Why pharmaceutical organizations are targeted​

Five reasons pharmaceutical organizations are targeted: research and intellectual property, personal and clinical data, uptime pressure, geopolitical influence, and ecosystem leverage. Examples and evidence boundaries are explained below.
Figure 1. Five targeting motives. Select the image to inspect the original. The examples span manufacturers and their ecosystem: Lash Group is a Cencora subsidiary serving a Pfizer patient-support program, not a Pfizer subsidiary. Novo's confirmed trial-data exposure was pseudonymized; the graphic does not imply that every named organization lost directly identifying clinical records. The sections below provide the incident-specific sources and limits.

Research and intellectual property​

Drug discovery, formulation, assay data, clinical development, manufacturing know-how, regulatory strategy, and source code can carry strategic or commercial value. In 2020, the UK National Cyber Security Centre, Canada's Communications Security Establishment, the US National Security Agency, and CISA assessed that Russia's APT29 had targeted organizations involved in COVID-19 vaccine development in Canada, the United States, and the United Kingdom, likely to steal development and testing information. (NCSC joint advisory)

A US indictment alleged that China-based operators Li Xiaoyu and Dong Jiazhi, acting in some operations for the Ministry of State Security, searched for vulnerabilities at biotech and pharmaceutical companies researching COVID-19 vaccines, testing, and treatment and had previously stolen pharmaceutical trade secrets, including chemical structures. An indictment records criminal allegations, not a conviction on every alleged act, but it is strong evidence of government investigative judgment and the stated targeting objective. (US Department of Justice)

Sensitive personal and clinical data​

Patient-support programs, safety reporting, clinical trials, medical affairs, and workforce systems create large stores of personal and health-related information. Cencora disclosed that data exfiltrated from its systems might contain personal information. A Massachusetts breach notice for its Lash Group subsidiary and a Pfizer program listed fields that could include names, contact information, dates of birth, diagnoses, and medication or prescription information. The notice said there was no evidence at that time that the information had been publicly disclosed or used fraudulently. Novo Nordisk later confirmed that its 2026 incident exposed healthcare-professional names and registration numbers and, depending on the record, email addresses, telephone or WhatsApp details, and office locations. Its notice warned that the information could support targeted phishing or impersonation of colleagues. (Cencora Form 8-K; Massachusetts breach notice; Novo Nordisk HCP notice)

Uptime and recovery pressure​

Production, laboratory, distribution, pharmacovigilance, and regulated recordkeeping depend on systems whose unavailability can become a business and public-health issue. Attackers do not need to understand the entire production process to exploit that dependency: encrypting enterprise services, disrupting identity, or forcing precautionary isolation can impose recovery costs and increase extortion leverage.

This does not mean every ransomware event stops manufacturing or creates a drug shortage. The effect is incident-specific. Dr. Reddy's said it isolated affected services after a 2020 ransomware event and later stated that it found no evidence of a personal-data breach. Sun Pharma initially said its core systems and operations were not affected, then later reported that business operations had been impacted and that it expected reduced revenue and additional expenses. (Dr. Reddy's Q2 FY2021 materials; Dr. Reddy's May 2021 update; Sun Pharma initial notice; Sun Pharma update)

Geopolitical and public-confidence effects​

The pandemic concentrated national attention on vaccine science, approval, and logistics. EMA reported that attackers accessed a limited IT application holding COVID-19 vaccine information. Some stolen material was later published after data from different users had been combined and documents had been retitled or annotated, creating a second-order integrity and public-confidence problem beyond confidentiality loss. (EMA incident review; EMA update)

Ecosystem leverage​

An external dependency can aggregate multiple sponsors, programs, or geographies. CROs, laboratories, regulators, distributors, cloud platforms, managed service providers, and file-transfer products may hold data from more than one pharmaceutical company. Compromising one of these nodes can be cheaper than breaching each sponsor individually. That aggregation is a structural risk, not proof that every third party is less secure.

The February 2024 Change Healthcare ransomware incident disrupted pharmacy and prescription-claims processing and affected access to medications. It demonstrates how failure at a claims and payment hub can propagate into the pharmaceutical ecosystem without breaching a drug manufacturer. (UnitedHealth Form 8-K/A exhibit)

The pharmaceutical attack surface​

The useful unit of analysis is the end-to-end product and data lifecycle, not merely the corporate network.

Pharmaceutical dependency map: researchers and partners use email and identity, SaaS and cloud, research and clinical data, and regulatory exchange. Shared enterprise administration connects these services to manufacturing and laboratories, then distribution and patient programs.
Figure 2. A conceptual map of product, data, and administrative dependencies—not a reconstructed intrusion chain. Arrows describe potential dependencies, not proven lateral movement or mandatory network connections. Select the image to inspect the original. The table below explains each surface and links directly to its supporting evidence.
SurfaceWhy it mattersEvidence from the case setDefensive question
Email, identity, and endpointsCredentials and user execution can provide access without exploiting a serverIBM documented credential-harvesting HTML attachments impersonating Haier Biomedical in a vaccine cold-chain campaignAre high-value roles protected by phishing-resistant MFA, device-bound access, and anomalous-session detection?
Internet-facing applications and managed file transferA single remotely exploitable flaw can support rapid, repeatable theftCl0p exploited MOVEit Transfer through CVE-2023-34362 and deployed LEMURLOOTIs every exposed service inventoried, KEV-prioritized, logged, and removable from the internet when not required?
Windows identity and enterprise administrationCredentials, SMB, WMI, and service execution can turn one foothold into enterprise-wide impactMITRE documents credential theft and several remote propagation methods for NotPetyaCan privileged credentials from one tier administer R&D, backup, or production-support systems?
Cloud, SaaS, repositories, and data platformsResearch and operational data are increasingly distributed across services and tokensNovo's public notice confirms data exposure without identifying the access path; that uncertainty itself requires broad telemetryAre secrets short-lived, repositories classified, service principals reviewed, and bulk export observable?
Regulatory and partner exchangeA regulator or partner may hold sensitive submissions outside the sponsor's perimeterPfizer/BioNTech documents were accessed through EMA, while Pfizer said its own systems were not breachedCan the organization enumerate where every submission and trial dataset is copied, retained, and shared?
CROs, distributors, and patient-support providersAggregators combine multiple companies' data and business processesInotiv experienced encryption and disruption; Cencora confirmed exfiltration; the Lash notice identified health-related fieldsDo contracts specify logging, evidence preservation, notification, recovery objectives, and data deletion?
Laboratories and R&D instrumentsSpecialized systems combine valuable data with vendor dependencies and long lifecyclesThe joint government advisory demonstrates explicit targeting of vaccine and pharmaceutical researchAre instrument networks segmented, remote support controlled, and research exports monitored?
Manufacturing OT and building systemsAvailability, product quality, worker safety, and validated state can constrain changes and recoveryWest disclosed that exfiltration, system encryption, and precautionary global isolation temporarily disrupted operations; shipping, receiving, and manufacturing restarted at some sites before full recovery. FDA and NIST guidance emphasize asset visibility, zones and conduits, vendor components, testing, and compensating controlsCan a loss of enterprise identity, enterprise applications, or virtualization interrupt production, even if controllers are untouched?
Backups and recovery infrastructureRecovery speed determines the operational leverage of destructive malware and ransomwareMerck, Sun Pharma, Inotiv, and Stryker all disclosed material restoration or continuity workAre identity, configuration, recipes, batch records, and validation evidence recoverable in isolated exercises?
Privileged insiders and security providersLegitimate expertise can bypass ordinary controls or improve extortion strategyDOJ documented cybersecurity professionals acting as ALPHV affiliates against medical and engineering organizationsAre privileged actions independently logged, dual-controlled, and reviewed across employee and contractor accounts?

FDA's 2025 white paper explains why manufacturing deserves distinct treatment. Connected operational technology is commonly optimized for consistent function and long service life, while embedded vendor components, legacy accounts, remote access, and incomplete visibility complicate security. FDA recommends inventory, segmentation through zones and conduits, controlled access, and hardware/software bills of materials. NIST SP 800-82 Rev. 3 adds an operational constraint: patches may require testing, validation, and maintenance windows, while unsupported systems may need compensating controls. These are arguments for engineering discipline, not for accepting permanent insecurity. (FDA, Cybersecurity for Advanced Manufacturing; NIST SP 800-82 Rev. 3)

Threat actors, motives, and attribution confidence​

Actor names are a source of error. Name links lead to an existing actor dossier or a cited advisory/report; dossier context does not independently verify an incident, and claim-report links do not confirm an attacker’s assertion. Sandworm is not APT28; Lazarus is not APT27; APT41 is not Storm-0558. ATT&CK maintains separate group records because overlapping nationality, tooling, or targeting does not make clusters interchangeable. (Sandworm; APT28; Lazarus Group; APT38; APT27; APT41)

Actor or categoryPrimary motive in this contextRelevant public evidenceAttribution boundary
Sandworm / Russian GRUDestructive or strategic state actionThe US charged six GRU officers over NotPetya and other operations; NotPetya caused severe pharmaceutical collateral damage at MerckStrong government attribution for NotPetya; it does not make every Russian pharmaceutical intrusion “Sandworm”
APT29 / Russian intelligenceStrategic espionageThe 2020 NCSC-led advisory assessed vaccine-development targeting and use of WellMess and WellMailStrong multi-government assessment for the campaign; not proof of access to every named research program
China MSS-linked operatorsEconomic and strategic espionageA US indictment alleged targeting of COVID-19 research and theft of pharmaceutical trade secretsAllegations in a criminal charging document; individual incidents still require evidence
Winnti-associated activityLong-term espionageBayer said it found Winnti malware, monitored the intrusion, and saw no evidence of data theft, according to Reuters reportingA victim statement reported by a reputable wire service; no basis to inflate it into confirmed IP theft
STRONTIUM / APT28Strategic espionage and credential theftMicrosoft assessed that the Russia-linked cluster used password spraying and brute-force login attempts in a campaign targeting seven vaccine or treatment organizations across Canada, France, India, South Korea, and the United StatesVendor attribution; Microsoft said most attacks were blocked. STRONTIUM is distinct from Sandworm, and targeting does not establish successful theft
North Korea-linked ZINC and CERIUMEspionage and account compromiseMicrosoft assessed that the clusters targeted pharmaceutical companies and vaccine researchers in several countries in 2020Vendor assessment; it does not prove the widely repeated claim that Lazarus successfully stole Pfizer vaccine research
Cl0pScalable data theft and extortionCISA and partners documented exploitation of MOVEit Transfer and the LEMURLOOT web shellStrong technical attribution for the campaign; impact on a particular pharma company requires victim-level evidence
ALPHV / BlackCat affiliatesRansomware and data-extortion revenueCISA, FBI, and HHS describe the RaaS ecosystem and observed TTPs; DOJ later prosecuted cyber professionals who acted as affiliatesAffiliate operations vary. A leak-site listing is a lead, not independent proof of a victim's full claimed loss
QilinRansomware and data-extortion revenueQilin claimed Inotiv and published file-volume assertions; Inotiv independently confirmed intrusion, encryption, possible acquisition, and disruptionVictim impact is confirmed; actor identity and claimed volume remain attacker-attributed
Unattributed intrudersEspionage, crime, or mixed objectivesEMA, Cencora, Sun Pharma, and Novo Nordisk did not name an actor in their principal public disclosures“Unknown” is an analytical result, not a gap to fill with the most convenient group name
Rogue professionals and insidersFinancial gain, sabotage, or espionageDOJ confirmed that three cybersecurity professionals acted as ALPHV affiliates and attacked medical and engineering organizationsThis proves a threat class, not a dominant prevalence rate in pharma

This taxonomy prevents two common mistakes. First, nationality should not be inferred from a malware name, language clue, or hosting location. Second, motive should not be inferred solely from impact. A wiper can masquerade as ransomware; an espionage operation can later leak altered documents; a criminal group can steal research data without understanding its scientific value.

A verified incident timeline​

DateEntity or layerWhat is confirmedAttribution status and evidence limit
June 2017MerckNotPetya disrupted worldwide manufacturing, research, and sales. Merck reported approximately $260 million in lost 2017 sales and $285 million in 2017 expenses, net of $45 million in insurance recoveries; its 2018 filing reported approximately $150 million in additional lost sales for 2018US and allied governments attributed NotPetya to Russia; DOJ charged GRU officers. The often repeated single “$870 million audited loss” is not the figure reported in the cited 2017 filing
2018–April 2019BayerBayer said it detected Winnti malware in early 2018, monitored the compromised network, and removed the malware in 2019; it said there was no evidence of data theftBayer linked the malware to Winnti according to Reuters; the public record does not establish stolen Bayer IP
July 2020Vaccine-development organizationsA joint government advisory described APT29 targeting in Canada, the US, and UK and assessed that the likely objective was theft of vaccine-development and testing informationMulti-government assessment, not a public victim-by-victim forensic report
October 2020Dr. Reddy's LaboratoriesThe company reported ransomware, isolation of affected IT services, and restoration work; it later said it found no evidence of a personal-data breachNo actor named in the cited company materials
November 2020Pharmaceutical and vaccine researchersMicrosoft assessed that STRONTIUM used password spraying and brute force, ZINC used fake-recruiter spearphishing, and CERIUM used COVID-themed lures impersonating World Health Organization representatives against seven companies in Canada, France, India, South Korea, and the United StatesVendor assessment of targeting behavior, not evidence of successful theft. Microsoft said most attacks were blocked
December 2020EMA and Pfizer/BioNTech regulatory dataEMA confirmed unauthorized access to one application and later publication of manipulated material. Pfizer said documents in EMA's submission environment were accessed, while its and BioNTech's systems were not breached and no known trial participants were identifiedUnattributed. EMA's notices do not confirm the detailed MFA-token and rogue-device intrusion story repeated elsewhere
December 2020Vaccine cold chainIBM identified credential-harvesting messages using malicious HTML attachments and impersonating Haier Biomedical in a global campaignIBM assessed an espionage objective; campaign success and ultimate actor were unknown
November 2021Supernus PharmaceuticalsSupernus disclosed ransomware that encrypted files and impeded access to some systems. It said the event did not significantly affect operations, did not expect to pay ransom, and was evaluating a threat to publish copied dataNo actor named in the company filing; the notice establishes encryption and an extortion threat, not public release of the data
March 2023Sun Pharmaceutical IndustriesSun said file systems were breached, company and personal data were stolen, operations were affected, and reduced revenue and additional expenses were expectedThe company described a ransomware group but did not name it. ALPHV's listing is an attacker claim reported by the press
May–June 2023MOVEit ecosystemCl0p exploited CVE-2023-34362 in MOVEit Transfer, deployed LEMURLOOT, and exfiltrated data from compromised systemsStrong CISA/FBI partner evidence for the campaign; do not assume exposure for a specific pharma entity without a victim notice
February 2024 onwardChange Healthcare, an adjacent claims and pharmacy-transaction hubUnitedHealth said criminals used compromised credentials to access a Citrix portal without MFA, exfiltrated protected health information, and deployed ransomware that disrupted pharmacy, claims, and payment services. UHG later confirmed that it paid the demanded $22 million ransom in bitcoin. Its 2024 Form 10-K estimated approximately 190 million affected people; HHS records that Change updated the figure to approximately 192.7 million on 31 July 2025UHG told the Senate that responsibility was claimed by a criminal group known as ALPHV/BlackCat working with an affiliate. This remains adjacent health infrastructure, not a direct pharmaceutical-manufacturer breach
February 2024 onwardCencora / Lash Group patient servicesCencora disclosed data exfiltration and possible personal information. A program notice described contact, birth, diagnosis, and medication fields that could have been affectedNo actor or initial-access method identified in the cited filings and notice
August 2025Inotiv, a CROInotiv confirmed unauthorized access, encryption of portions of its environment, operational disruption, possible data acquisition, and offline alternatives. Its later Form 10-K reported three putative privacy class actionsQilin claimed the attack and data volume; Inotiv did not validate those details in the cited filings
March–April 2026Stryker, a medtech companyStryker disclosed a global Microsoft-environment disruption affecting order processing, manufacturing, and shipping. Later filings described a malicious file, containment, progressive restoration, and a material first-quarter but not expected full-year effectNo actor named. The filings show an evolving state of knowledge; the Claims section addresses unconfirmed actor, wipe, device-count, and control-plane assertions
May 2026West Pharmaceutical Services, a drug-containment and delivery supplierWest disclosed data exfiltration, system encryption, precautionary global system isolation, and temporary operational disruption. It later said all sites and its global manufacturing, supply-chain, and commercial operations were fully operationalCompany-confirmed material cyberattack; West did not label it ransomware or identify an actor in the cited filings
June 2026Novo NordiskThe company confirmed unauthorized access to limited internal systems, external copying of nonpublic and personal data, and temporary system isolation while core operations continued. Confirmed pseudonymized trial fields could include a random patient-ID string, trial participation, sex, year of birth, biomarkers, health or immunogenicity data, and lifestyle factors such as smoking, alcohol use, and BMI; Novo said the underlying information needed to identify patients was not exposed. Its HCP notice confirmed names, professional-registration numbers, email addresses, phone or WhatsApp details, and office locations and warned of targeted phishing by email, phone, or WhatsApp, including messages impersonating colleaguesNo actor, entry vector, claimed volume, AI or repository count, or ransom demand is confirmed in the company notices

Common TTPs and their evidentiary limits​

The table below separates campaign- or incident-specific behavior from broader actor tradecraft. The NotPetya, IBM cold-chain, Change Healthcare, and MOVEit rows are tied to named campaigns or incidents. The STRONTIUM row is vendor-reported campaign targeting. Rows marked “ALPHV actor-level” preserve mappings from the CISA, FBI, and HHS advisory and are not incident-specific to a named pharmaceutical victim. The table does not imply that every intrusion uses every technique.

PhaseTechniqueIDEvidence-backed exampleHigh-value telemetry
Initial accessCompromise Software Supply ChainT1195.002NotPetya was delivered through a malicious update to Ukrainian accounting software M.E.DocSoftware-update origin, package signing, unexpected child processes, new outbound destinations
Initial accessSpearphishing AttachmentT1566.001IBM's cold-chain campaign used malicious HTML attachments to harvest credentialsAttachment detonation, HTML-to-external-form behavior, lookalike sender/domain analysis
Credential access / targetingBrute Force: Password SprayingT1110.003Microsoft assessed that STRONTIUM used password spraying against vaccine and treatment researchers; this is vendor-reported targeting behavior, not proof of compromiseDistributed authentication failures, low-and-slow attempts across many accounts, legacy-authentication use
Initial accessExploit Public-Facing ApplicationT1190Cl0p exploited MOVEit Transfer CVE-2023-34362WAF/reverse-proxy logs, unusual SQL behavior, file creation in application directories, emergency KEV coverage
Initial accessValid AccountsT1078UnitedHealth said compromised credentials were used against Change HealthcareNew-device and impossible-travel signals, credential-risk events, authentication from rare networks
Initial accessExternal Remote ServicesT1133The compromised credentials were used through a remote Citrix portal that lacked MFAExternal-service inventory, MFA coverage, legacy-portal exceptions, rare source and device telemetry
PersistenceServer Software Component: Web ShellT1505.003LEMURLOOT masqueraded as a legitimate MOVEit ASP.NET fileIntegrity monitoring, rare server-side file hashes, anomalous application-pool activity
Credential accessOS Credential Dumping: LSASS MemoryT1003.001MITRE documents NotPetya obtaining credentials from LSASS using credential-dumping capabilityLSASS access, credential-tool signatures, privileged logons following endpoint compromise
Lateral movementExploitation of Remote ServicesT1210NotPetya used SMB exploits, including EternalBlue/EternalRomance behavior, to spreadEast-west SMB anomalies, vulnerable-host inventory, connection bursts to TCP 445
Lateral movementWindows Management InstrumentationT1047NotPetya used WMI with recovered credentials for remote executionRemote process creation, WMI consumer activity, unusual admin shares
Lateral movementRemote Services: SMB/Windows Admin SharesT1021.002NotPetya copied itself to administrative sharesRare admin-share writes and service creation across peer systems
ExecutionSystem Services: Service ExecutionT1569.002NotPetya used service execution as one propagation pathNew transient services, remote service-control activity, unsigned binaries from shares
Defense evasionValid Accounts: Local AccountsT1078.003NotPetya could use acquired local credentialsSame account on multiple hosts, unusual source device, logons outside administration paths
Defense evasionSystem Binary Proxy Execution: Rundll32T1218.011MITRE records NotPetya using rundll32.exe to execute its DLLCommand-line logging, DLL origin/reputation, unusual rundll32 network or file activity
ReconnaissancePhishing for InformationT1598ALPHV actor-level advisory: affiliates posed as IT or help-desk personnel and used calls or SMS messages to obtain credentialsHelp-desk impersonation reports, anomalous password resets, credential-phishing telemetry
Resource developmentCompromise AccountsT1586As mapped by CISA, ALPHV affiliates used credentials obtained through IT or help-desk impersonation to access target networksHelp-desk impersonation reports, anomalous password resets, credential-phishing telemetry
Credential accessCredentials from Password StoresT1555ALPHV actor-level advisory: affiliates obtained passwords from local networks, deleted servers, and domain controllersPassword-store access, deleted-server access, privileged credential retrieval
Credential accessSteal or Forge Kerberos TicketsT1558ALPHV actor-level advisory: affiliates used Kerberos token generation for domain accessAbnormal ticket requests, unusual encryption types, ticket use from rare hosts
Credential accessAdversary-in-the-MiddleT1557ALPHV actor-level advisory: affiliates used Evilginx2 to obtain MFA credentials, login credentials, and session cookiesReverse-proxy phishing domains, token replay, new sessions after suspicious sign-ins
Collection/exfiltrationExfiltration Over C2 ChannelT1041LEMURLOOT accepted commands through HTTP headers and returned compressed database output in the same web-shell channel; this is an analytical ATT&CK mapping from the documented behaviorLarge or repeated application responses, unexpected gzip output, database reads followed by outbound responses
ImpactData Encrypted for ImpactT1486MITRE maps NotPetya to T1486. Supernus, Change Healthcare, Inotiv, and West separately confirmed ransomware or system encryption; applying T1486 to those cases is an analytical mapping of observed impact, not a source-assigned techniqueMass file changes, shadow-copy or backup access, abrupt endpoint unavailability

CISA maps the ALPHV credential-acquisition sentence to T1586. ATT&CK defines T1586 as compromising accounts for use during targeting, whereas T1078 covers using existing credentials to access a victim environment. The table preserves CISA's published mapping; analysts should map observed account use to T1078 when that is the behavior the evidence supports. (MITRE T1586; MITRE T1078)

The detailed NotPetya mapping is supported by MITRE ATT&CK's software record. Microsoft had released MS17-010 before the June 2017 outbreak, so CVE-2017-0144 should not be called a zero-day in the Merck incident. NotPetya also used stolen credentials and legitimate remote-administration mechanisms; describing it as “just EternalBlue” misses the pathways that enabled spread even where one vulnerability was patched.

The MOVEit record is similarly precise. CISA and partners documented SQL injection through CVE-2023-34362, LEMURLOOT as an ASP.NET web shell, specially formed HTTP-header commands, creation of a rogue account named “Health Check Service,” and gzip-formatted output. Mapping that documented command-and-response behavior to T1041 is reasonable because the same HTTP web-shell channel carried commands and stolen database output; the mapping is analytical, not a claim that CISA assigned every victim the technique. These details are useful for retrospective hunting on MOVEit servers; they are not generic indicators for every Cl0p intrusion. (CISA MOVEit advisory)

ALPHV evidence broadens the defensive model but has a different scope. CISA, FBI, and HHS describe affiliates using social engineering, credential theft, adversary-in-the-middle tooling, legitimate remote-access and tunneling software, cloud-storage services, log clearing, exfiltration, and encryption. Those are government-observed ecosystem behaviors, not proof that the same chain occurred at Sun Pharma, Change Healthcare, or another specific victim. (CISA, FBI, and HHS ALPHV advisory)

Three analytical rules follow:

  • Map an observed behavior, not a presumed actor playbook. A victim's confirmation of data exfiltration does not prove phishing, credential dumping, Cobalt Strike, FTP, or cloud-storage exfiltration.
  • Separate initial access from propagation. In the NotPetya case, the poisoned update introduced the malware; SMB exploits and credentials spread it.
  • Time-bound indicators. Hashes, domains, filenames, and vulnerable versions age quickly. Current operational detection should be drawn from the latest authoritative advisory, not copied indefinitely from an unsourced appendix.

What the attacks achieve​

Operational disruption​

Merck is the clearest case of enterprise cyber impact reaching a pharmaceutical mission. Its 2017 filing described disruption to worldwide operations, including manufacturing, research, and sales. The disclosed 2017 components—approximately $260 million in lost sales and $285 million in expenses, net of $45 million in insurance recoveries—show why loss figures must be dated and decomposed. Its 2018 filing added approximately $150 million in lost sales for that year. The DOJ charging document said that three victims together—a US pharmaceutical manufacturer, Heritage Valley Health System, and TNT Express B.V. (a FedEx subsidiary)—suffered nearly $1 billion in losses from NotPetya. It did not assign that combined amount to the pharmaceutical manufacturer alone, and the combined prosecutorial statement should not replace Merck's dated accounting categories. (Merck 2017 Form 10-K; Merck 2018 Form 10-K; DOJ)

Operational effect is not binary. A company may keep core production running while losing parts of its Microsoft environment, may use offline alternatives while systems are restored, or may isolate services as a precaution. Those are materially different states and should be reported separately.

Confidentiality loss​

The likely high-value categories are not limited to drug formulas. They include regulatory submissions, trial and safety data, patient-support records, source code, manufacturing documentation, contracts, identity records, and internal communications. EMA, Cencora, Inotiv, and Novo Nordisk each publicly confirmed a form of unauthorized data access or possible acquisition, but the completeness and downstream use of that data remain only partly visible. Novo Nordisk's healthcare-professional notice makes the follow-on risk concrete: professional identifiers plus email, phone, WhatsApp, or office details can improve phishing and impersonation even when the dataset contains no drug formula.

Integrity and trust​

EMA's incident demonstrates that stolen authentic material can be recombined, retitled, annotated, or selectively published. Integrity risk therefore includes more than modification inside the victim network. Defenders need provenance, version history, authoritative publication channels, and a communication plan capable of explaining manipulated or context-stripped releases.

Costs can include lost sales, investigation, restoration, outside advisers, customer support, litigation, notification, and security improvement. Comparisons across incidents are unreliable when categories differ. UnitedHealth reported $2.2 billion in 2024 “direct response costs,” but its 10-K says that category included costs associated with interest-free provider loans and increased medical-care expenditures after it suspended some care-management activities, alongside network restoration and notifications. It separately estimated $867 million in business-disruption impacts. UHG also confirmed to the Senate that it paid the demanded $22 million ransom in bitcoin. That victim-confirmed payment contrasts with the anonymously sourced Cencora report described below; none of these figures should be collapsed into a single incident-cost measure or treated as a pharmaceutical-manufacturer loss. (UnitedHealth 2024 Form 10-K; UnitedHealth Senate responses)

For US public companies, the SEC's Item 1.05 deadline generally runs four business days after the registrant determines that a cybersecurity incident is material—not four days after intrusion or discovery. The materiality determination must be made without unreasonable delay. (SEC Division of Corporation Finance) In regulated production, restoration also has to preserve trustworthy records and validated operation; FDA Part 11, API GMP guidance, and EMA GMP data-integrity guidance make integrity and auditability part of recovery design, not a post-incident paperwork exercise. (FDA Part 11 guidance; FDA Q7A guidance; EMA GMP/GDP Q&A)

Public-health consequences​

The connection to public health should be stated carefully. Cyber disruption can reduce output, delay research or distribution, or complicate access to patient-support services. It does not follow that every incident created a shortage or endangered a patient. Claims of clinical impact require supply, quality, safety, or health-system evidence beyond proof of an intrusion.

Detection and defense architecture​

For implementation, connect the findings to the CTI-to-detection workflow, telemetry and logging architecture, and detection engineering methodology. The Anomaly Detection Atlas provides related behavioral-analysis context; anomalous activity still requires investigation, not automatic malicious attribution.

A useful program connects business-critical evidence to technical controls. NIST CSF 2.0 provides six organizing functions—Govern, Identify, Protect, Detect, Respond, and Recover—while CISA's Cross-Sector Cybersecurity Performance Goals provide a prioritized baseline for IT and OT. Neither substitutes for site-specific product, quality, and safety analysis. (NIST CSF 2.0; CISA CPGs)

Govern the crown jewels and dependencies​

Maintain a decision-useful inventory of:

  • active research programs, source repositories, models, assay and trial datasets;
  • regulatory submissions and every external location where copies exist;
  • GMP-critical applications, batch records, recipes, historians, engineering workstations, and remote-support paths;
  • identity providers, hypervisors, backup control planes, network management, and other shared services whose loss can cross zones;
  • CROs, CMOs, laboratories, distributors, patient-service providers, and software services, including data types, retention, and recovery commitments.

The inventory should identify an accountable business and quality owner, not just a hostname. For OT, pair network discovery with engineering review so active scanning does not create unsafe behavior.

Protect identity and privileged paths​

Use phishing-resistant MFA for administrators, remote access, developers, researchers with high-value data, and third-party support. Eliminate shared accounts where feasible; vault and rotate non-human credentials; make service principals short-lived and narrowly scoped; and prevent corporate-tier credentials from administering OT, backup, or security infrastructure. Conditional access should evaluate device health and session risk, not only possession of a second factor.

The relevant detection is not merely “many failed logins.” Watch for a new device registering to a privileged account, impossible or unusual travel, consent grants, abnormal token use, dormant service accounts becoming active, and privilege changes followed by bulk access. Treat cloud identity and endpoint-management platforms as production control planes: Microsoft recommends least privilege, phishing-resistant authentication, and multi-admin approval for high-impact Intune actions such as device wipe and script deployment. For the separate evidence boundary around reported Stryker control-plane abuse, see Claims that should not be repeated as fact. (Microsoft Intune RBAC; Microsoft Entra phishing-resistant MFA; Microsoft Intune setup guidance)

Reduce exposed-service risk​

Continuously reconcile external attack-surface discovery with the configuration inventory. Prioritize vulnerabilities listed in CISA's Known Exploited Vulnerabilities Catalog, but do not ignore exposed end-of-life systems or weak authentication merely because no CVE is present. (CISA KEV Catalog)

For managed file transfer and similar appliances:

  • minimize internet exposure and administrative interfaces;
  • centralize application, reverse-proxy, authentication, database, and file-integrity logs;
  • define a rapid isolation procedure that preserves forensic data;
  • hunt for web shells and unauthorized service accounts after emergency patching;
  • treat evidence of server compromise as a data-exposure investigation, not only a patching task.

Contain enterprise-to-R&D and enterprise-to-OT paths​

Segment by consequence, administration, and data flow. A firewall rule alone is not a security boundary if both zones trust the same privileged identity, virtualization platform, endpoint-management tenant, DNS service, or backup console. FDA's zones-and-conduits model and NIST's OT guidance support explicit, monitored pathways and compensating controls where patching is constrained.

For critical production environments, recovery exercises should demonstrate more than server boot. They should show that configurations are correct, records remain attributable and complete, time is synchronized, interfaces behave as expected, and quality can determine whether product or batch evidence was affected.

Detect collection and exfiltration​

Build detections around behavior that precedes disclosure. The telemetry and questions below are analyst recommendations; inline sources document the underlying behavior or evidence problem, not tested detection performance:

BehaviorUseful evidenceInvestigation question
Unusual research or trial-data accessData-platform audit logs, query volume, repository clone eventsIs access consistent with the user's role, study, geography, and normal volume?
Bulk archive or stagingEndpoint process and file telemetry, temporary storage growthWas sensitive data compressed or collected before a network transfer?
New export mechanismOAuth grants, API tokens, service-account creation, transfer jobsWas a new application or identity authorized to read large datasets?
Abnormal egressProxy, DNS, firewall, cloud-flow, application-response logsIs volume, destination, timing, or protocol inconsistent with the workflow?
Remote administration across zonesWMI, service control, RDP, SMB, jump-host logsIs this an approved maintenance path with an authorized ticket and device?
Web-shell behaviorServer file integrity, child processes, HTTP fields, application logsDid an internet-facing application create files, accounts, shells, or large responses?
Integrity anomalyVersion history, signatures, hashes, provenance recordsWas source material altered internally, or only repackaged after theft?

Retention must cover the dwell time and investigation window. Logging that is inaccessible after identity or virtualization failure is not resilient logging.

Engineer recovery for regulated operations​

Keep immutable or offline recovery copies for identity, configurations, critical data, and supporting validation evidence. Test restoration under realistic dependencies. A clean backup is insufficient if the organization cannot establish which records changed, revalidate a system, reconnect an instrument safely, or operate while a supplier remains unavailable.

CISA's ransomware guidance recommends preventive controls and a structured response checklist. In pharma, the incident command structure should add quality, manufacturing, clinical, safety, privacy, legal, communications, and supply functions at the beginning—not after IT containment. (CISA StopRansomware Guide)

Make third-party security observable​

Questionnaires are not enough for services that aggregate sensitive data or can interrupt critical work. Contracts and technical design should cover:

  • data minimization, segregation, retention, and verified deletion;
  • strong identity controls and restricted support access;
  • vulnerability and end-of-life management for exposed services;
  • log retention and the right to obtain incident evidence;
  • notification thresholds, timelines, and named communication paths;
  • tested recovery objectives and manual alternatives;
  • subcontractor visibility and exit procedures.

When a vendor is compromised, the sponsor should be able to revoke trust, rotate secrets, identify exposed data, and continue the highest-priority activity without waiting for perfect attribution.

Where to start: a prioritized sequence​

A defensible program needs sequence, owners, and completion evidence. These are reasoned defensive links to observed failure modes, not proof that any one control would have prevented a cited incident. The 30/90/180-day windows are a proposed planning sequence, not deadlines prescribed by the linked sources.

WindowPriority actionsReasoned link to the case setEvidence of completion
First 30 daysAssign owners for crown jewels and critical providers. Inventory internet-facing remote-access and file-transfer services. Enforce phishing-resistant MFA for privileged and remote access, with time-bound exceptions. Apply least privilege and multi-admin approval to destructive Intune actionsPassword spraying and credential harvesting show identity risk; MOVEit shows exposed-service risk; Microsoft documents controls for high-impact Intune administrationSigned ownership register; owner-reconciled exposure inventory; MFA coverage and exception report; exported role and approval configuration
By day 90Separate corporate, R&D, OT, backup, and security administration. Centralize durable identity, remote-access, file-transfer, endpoint-management, export, and privileged-action logs. Test detections for password spraying, privileged-device changes, web shells, abnormal database responses, bulk access, and first-seen toolsTiering constrains NotPetya-style trust paths. Durable telemetry targets documented LEMURLOOT and ALPHV behavior and reduces incident uncertaintyApproved trust-path diagram; blocked cross-tier credentials; retained test events; detection tests with analyst disposition
By day 180Restore identity, one regulated application, and one production-support dependency. Validate configuration, audit trails, data integrity, time synchronization, and quality-release criteria. Exercise disclosure, data scoping, trust revocation, manual continuity, and anti-phishing communications with a critical partnerThe case set shows that restoration, ecosystem dependencies, and communications require rehearsal. Exercises measure restore time and expose unresolved dependencies; they do not guarantee continuityTimed restore report; quality-owner sign-off; unresolved-dependency register; tabletop after-action report; tested notification and revocation procedures

Sources for the prioritization table: Microsoft vaccine-targeting assessment, IBM X-Force, CISA MOVEit advisory, Microsoft Intune RBAC, Microsoft Entra phishing-resistant MFA, Microsoft Intune setup guidance, MITRE NotPetya, CISA ALPHV advisory, UnitedHealth 2024 Form 10-K, Cencora Form 8-K, West Form 8-K, Stryker 12 March Form 8-K, and Novo Nordisk incident update.

Claims that should not be repeated as fact​

Deep research is as much about removing attractive false precision as adding detail.

  • Stryker: “Handala wiped and factory-reset 200,000 devices.” Stryker's filings and the Unit 42 letter confirm operational disruption, a malicious file, malicious binaries, and unauthorized persistence, but not Handala, Intune abuse, a wiper, or that device count. Sygnia published a vendor assessment arguing that the reported incident illustrates how compromised Entra ID and Intune privileges could provide a destructive control plane without conventional malware; Stryker has not confirmed that mechanism. (Stryker 23 March Form 8-K; Unit 42 letter; Sygnia assessment)
  • Novo Nordisk: criminal claims about actors, access paths, volumes, ransom demands, and AI assets. Novo Nordisk's notices do not confirm FulcrumSec, a leaked-token vector, the claimed data volumes, or either ransom demand. Clinical Research News reported that a second group claimed a distinct incident and demanded $50 million. Paubox later reported that FulcrumSec released another cache it claimed contained AI models, datasets, and research material. Both remain attacker claims reported by secondary sources, not victim-confirmed facts. (Clinical Research News; Paubox)
  • EMA: “Spearphishing captured an MFA token and enrolled a rogue mobile device.” EMA confirms access, the targeted application, data theft, and manipulated publication. The cited official record does not establish that detailed access chain.
  • Inotiv: “Qilin stole 176 GB and disrupted 9,500 clinical trials.” Inotiv confirms encryption, disruption, and possible data acquisition. Qilin's volume is an attacker claim; the approximately 9,542 figure reported elsewhere referred to notifications, not disrupted clinical trials.
  • Cencora: “Dark Angels received a confirmed $75 million ransom from Cencora.” Bloomberg, citing unnamed sources, reported that Dark Angels received $75 million in three Bitcoin installments in March 2024 after an initial $150 million demand. Bloomberg also reported that Cencora declined to comment and said it does not respond to rumor or speculation. TechTarget notes that Zscaler and Chainalysis had earlier reported a $75 million payment to Dark Angels without naming the victim. Cencora's Form 8-K/A confirms additional data exfiltration but does not identify Dark Angels or report a ransom payment. The payment is therefore reported, not victim-confirmed. (Bloomberg; TechTarget; Cencora Form 8-K/A)
  • Merck: “NotPetya was ransomware using a zero-day that caused an audited $870 million loss.” NotPetya was destructive malware, Microsoft had already issued MS17-010, and Merck's filings report costs and lost sales by period rather than that exact formulation.
  • “Lazarus/APT38/APT27” and “Sandworm/APT28” are interchangeable. They are not. These labels refer to distinct ATT&CK groups or subclusters and must not be collapsed.
  • Generic breach-cost and dark-web record-price figures prove pharmaceutical risk. They often come from healthcare-wide samples, surveys, or opaque estimates. They should not replace victim-specific financial records.
  • An IOC appendix remains safe indefinitely. Indicators decay and can produce false positives. Operational teams should retrieve current, contextualized indicators from authoritative advisories and validate them before blocking.

An analyst checklist​

Before publishing or briefing a pharmaceutical cyber incident, answer these questions:

  1. Did the event affect a manufacturer directly, or a regulator, CRO, distributor, software provider, patient program, or medtech neighbor?
  2. Which facts come from the victim, a government, a vendor, the attacker, or anonymous reporting?
  3. Is the actor named by a competent authority, technically assessed, merely claimed, or unknown?
  4. Is the alleged initial-access method observed in this incident or borrowed from the actor's general playbook?
  5. Is “data stolen” confirmed, considered possible, or only asserted on a leak site?
  6. Are record counts, file volumes, ransom demands, and downtime periods independently supported?
  7. Did IT disruption actually reach manufacturing, research, distribution, product quality, or patient care?
  8. Is the financial figure a ransom, expense, lost sales, insurance recovery, market movement, or modeled average?
  9. Are ATT&CK techniques mapped to observed behavior with a source and date?
  10. Has the report preserved uncertainty, corrected aliases, and excluded unsafe or stale indicators?

Limitations​

This research uses public information. Public companies disclose what securities law and business judgment require; private organizations may say little; national-security evidence can remain classified; and victim notices may evolve. Consequently, incident counts understate reality, while leak-site counts can overstate it through duplicates, failed intrusions, recycled data, or false claims.

The article does not claim that the selected cases are statistically representative of all pharmaceutical organizations or countries. ENISA's public dataset is useful context but covers the broader health sector and a defined region and period. Company filings establish reported effects, not a complete forensic timeline. Government indictments contain allegations until adjudicated. Vendor research can provide valuable telemetry but should remain labeled as vendor assessment.

No exploit instructions or reusable victim indicators are included. Defenders conducting validation should use current vendor and government advisories in an authorized environment.

Conclusion​

The pharmaceutical cyber threat landscape is best understood as a set of intersecting missions and dependencies. State services pursue scientific and strategic information. Criminal affiliates monetize data and downtime. Destructive operations can cause enormous collateral damage. Shared identity, file-transfer, regulatory, research, and distribution systems extend exposure beyond any one company perimeter.

The durable defensive lesson is not to predict one actor. It is to make critical data and operational dependencies visible; constrain identity and administration across corporate, R&D, and OT tiers; rapidly reduce exposed-service risk; detect collection and exfiltration; and rehearse recovery in a way that preserves quality, integrity, and continuity. Just as important, threat intelligence must distinguish confirmed facts from assessments and attacker claims. In a sector built on evidence, cyber reporting should meet the same standard.

References​

Primary victim, regulator, and securities records​

Government and standards sources​

Research and contemporaneous reporting​

Follow My Work​

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware-analysis projects, AI-security research, open-source tools, labs, and technical guides.

Published · Last updated