← Back to Security Blog

보안 브리핑: TriZetto 의료 침해, 중국 통신사 공격 & Wikipedia 웜 — 2026년 3월 7일

A healthcare IT breach exposes 3.4 million patient records, China-linked hackers deploy three novel implants against South American telecom infrastructure, Wikipedia suffers a self-propagating JavaScript worm, and a multi-stage 악성코드 campaign delivers triple RAT 페이로드s via fileless execution. Here's everything you need to know today.

---

🏥 TriZetto 의료 침해로 340만 환자 기록 노출

What 노출되었습니다?

The breach targeted a web portal used for insurance eligibility verification. The compromised data includes:

• Full names and physical addresses
• Social Security numbers
• 날짜s of birth
• Health insurance member numbers
• Medicare beneficiary identifiers
• Provider and insurer names
• Demographic, health, and insurance information

Timeline & Response

날짜	Event
아니오vember 19, 2024	Unauthorized access begins
October 2, 2025	Suspicious activity detected
December 9, 2025	Affected providers notified
February 2026	Customer notifications begin
March 6, 2026	Maine AG filing confirms 3.4M affected

---

🇨🇳 중국 연계 UAT-9244, 남미 통신사에 3종 신종 임플란트 배포

The Triple-Implant Arsenal

Implant	Target Platform	Capabilities
TernDoor	Windows	DLL side-loading via wsprint.exe, process manipulation via embedded kernel driver, C2 communication
PeerTime (angrypeer)	Linux	Backdoor access, file operations, system reconnaissance
BruteEntry	Network edge devices	Edge device persistence, network traffic interception

Attribution & Connections

UAT-9244 is closely associated with FamousSparrow, which shares tactical overlaps with Salt Typhoon — the China-nexus group notorious for targeting telecom providers globally. TernDoor is a variant of CrowDoor/SparrowDoor, featuring new command codes and an embedded Windows driver for process control.

Key technical details:

• 초기 접근 — Exploiting outdated Windows Server and Exchange Server instances, deploying web shells
• Persistence — Scheduled tasks and Registry Run keys
• Self-destruct — TernDoor supports a -u switch for complete artifact removal
• Multi-platform coverage — Windows, Linux, and edge devices all compromised simultaneously

---

🌐 Wikipedia, 자기 전파 JavaScript 웜 공격 받아

How the Worm Spread

The attack 익스플로잇ed Wikipedia's JavaScript customization features — specifically the MediaWiki:Common.js and User:<username>/common.js scripts that execute in editors' browsers:

1. Origin — A malicious script (User:Ololoshka562/test.js) was uploaded to Russian Wikipedia, reportedly in March 2024
2. Trigger — The script was executed (possibly accidentally) by a Wikimedia employee account during testing
3. User-level propagation — Overwrote each logged-in editor's common.js with a loader for the malicious script
4. Site-wide escalation — If the infected user had admin privileges, the global MediaWiki:Common.js was modified, affecting all editors
5. Vandalism — Automated edits added hidden scripts and vandalism to Meta-Wiki pages

Containment

Wikimedia engineers temporarily restricted editing across all projects while they investigated and reverted changes. The incident highlights how user-customizable JavaScript in collaborative platforms can become an attack vector — particularly when privileged accounts execute untrusted code.

---

🐛 VOID#GEIST: 다단계 파일리스 악성코드, 트리플 RAT 페이로드 전달

Attack Flow

Stage	Technique	Purpose
1	Obfuscated batch script via 피싱	초기 접근, decoy PDF display
2	Second batch script deployment	Orchestration layer
3	Legitimate Python runtime staging	Portability, trusted binary abuse
4	Encrypted shellcode decryption	Payload preparation
5	Early Bird APC injection into explorer.exe	In-memory RAT execution

Why It's Dangerous

• Completely fileless — RATs execute entirely in memory via process injection
• Legitimate tools abused — Uses embedded Python runtime and batch scripts that mimic admin activity
• Triple 페이로드 — Deploys XWorm, AsyncRAT, and Xeno RAT simultaneously for redundancy
• TryCloudflare abuse — Initial delivery uses Cloudflare's free tunneling service
• Decoy distraction — Opens a full-screen PDF invoice while executing silently in background

---

💰 가나 국적자, 1억 달러 BEC 사기 조직 유죄 인정

The case highlights the industrial scale of BEC operations and their continued effectiveness despite years of awareness campaigns. 핵심 포인트:

• BEC remains the #1 financial cybercrime — FBI's IC3 data consistently shows BEC causing more monetary losses than 랜섬웨어
• International cooperation — The prosecution involved cross-border law enforcement coordination
• Combined tactics — The ring used both BEC (targeting businesses) and romance scams (targeting individuals) for maximum revenue
• Money laundering networks — Sophisticated networks of money mules were used to move stolen funds

---

🔍 Bing AI, 인포스틸러를 유포하는 가짜 OpenClaw GitHub 저장소 홍보

This incident is particularly concerning because it demonstrates how AI-generated search summaries can be manipulated to promote malicious content with an air of authority:

• SEO poisoning meets AI — Attackers 익스플로잇ed Bing's AI summarization to surface fake repos in prominent search positions
• Trusted context — Users trusting AI-curated results may lower their guard when following installation instructions
• GitHub as delivery platform — Malicious repos mimicking legitimate tools continue to be a growing attack vector
• Dual 페이로드 — Victims received both infostealers (자격 증명 theft) and proxy 악성코드 (using victim machines as relay nodes)

---

🛡️ 오늘의 완화 우선순위

For 의료 기관

1. Audit web portal access controls — Implement MFA on all patient data systems
2. 모니터링 for long-dwell intrusions — Deploy behavioral analytics to detect persistent unauthorized access
3. Review vendor security — Assess third-party healthcare IT providers' security postures

For Telecom & 치명적 Infrastructure

1. Patch Exchange and Windows Server — UAT-9244 익스플로잇s outdated systems
2. 모니터링 edge devices — Check for BruteEntry indicators on network perimeter equipment
3. Hunt for DLL side-loading — Look for suspicious wsprint.exe activity

For All Organizations

1. Implement CSP headers — Restrict JavaScript execution on web platforms
2. 모니터링 for fileless attacks — Tune EDR for Early Bird APC injection patterns
3. Verify software sources — Never install tools from AI search results without verification
4. BEC awareness training — Reinforce invoice and payment change verification procedures

---

📊 위협 환경 요약

Threat	Actor	Severity	Action Required
TriZetto healthcare breach	Unknown	🔴 치명적	Audit healthcare vendor security, monitor for identity theft
UAT-9244 telecom attacks	China-linked	🔴 치명적	Patch servers, hunt for TernDoor/PeerTime/BruteEntry
Wikipedia JS worm	Unknown	🟠 높음	Implement CSP, restrict privileged script execution
VOID#GEIST triple RAT	Cybercriminals	🔴 치명적	모니터링 for fileless attacks, block TryCloudflare abuse
$100M BEC fraud ring	Organized crime	🟠 높음	Reinforce BEC awareness and payment verification
Fake repos via Bing AI	Cybercriminals	🟠 높음	Verify software sources, educate developers