GENERAL__2021__HSE_Conti_140521_UPDATE.pdf

NCSC Ireland reports a likely Conti ransomware attack affecting the Health Service Executive (HSE) network on 14 May 2021, with DoH activity detected during the investigation. The document details initial indicators such as cobalt strike beacons and lateral movement methods, the impact on health services, and comprehensive remediation steps including isolating domain controllers, blocking egress, rebuilding systems, and restoring services, while outlining ongoing monitoring and guidance to mitigate further risk.