University of Kentucky

Summary

The University of Kentucky and its healthcare division experienced a significant cyber attack involving unidentified foreign threat actors who infiltrated their systems, deploying malware to exploit the institution's processing resources for cryptocurrency mining. The month-long intrusion, described as the most substantial in the university's history, severely disrupted computer operations, necessitating a full system reboot to mitigate the attack. The incident impacted academic and healthcare services across the affected networks.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early February 2020, unidentified threat actors operating from outside the United States infiltrated the computer systems of the University of Kentucky and its affiliated UK HealthCare network. The attackers deployed malware designed to exploit the university’s extensive processing resources for cryptocurrency mining operations, including Bitcoin. This cyber intrusion persisted undetected for approximately one month, marking the most severe cybersecurity incident in the institution’s history. The malware’s cryptocurrency mining activity leveraged UK’s infrastructure to generate computational work for financial gain without authorization. University officials, including Executive Vice President for Finance and Administration Eric Monday, publicly confirmed the foreign-origin attack but did not disclose technical specifics of the initial compromise vector or the exact malware strain used. The prolonged duration of the attack indicated sustained unauthorized access to critical systems across both academic and healthcare networks.

By early March 2020, the university initiated a comprehensive system reboot to disrupt the malicious activity, executing this measure during overnight hours on a Sunday to minimize operational interference. The reboot affected all compromised systems university-wide and within UK HealthCare, terminating the cryptocurrency mining operations. Officials characterized the incident as a resource hijacking attack rather than a data breach, with no evidence suggesting theft or exposure of sensitive personal or research data. The month-long infection caused significant system performance degradation, though the university did not quantify operational or financial impacts. No ransomware deployment or data destruction was reported. Recovery efforts focused on restoring normal system functionality post-reboot, with no mention of coordinated law enforcement actions or attribution to specific threat groups in the public disclosure.

Sources

Sources available to members: 1 source.