RDP Is the Entry Point. File Operations Are the Attack.
SonicWall’s latest threat data confirms what healthcare IT teams already know: remote desktop tools are the most common entry point for attackers targeting hospitals and medical facilities. RDP credentials get phished, brute-forced, or purchased on dark web markets. Once inside, attackers deploy ransomware or exfiltrate patient records.
But here’s the part that matters: gaining RDP access isn’t the attack that causes harm. It’s what happens next.
Ransomware has to write files to disk — either the ransomware executable itself or the encrypted versions of your patient records. Data exfiltration requires reading PHI files from your EHR, PACS, or laboratory systems before transmitting them out of your network.
Both are file system operations. Both happen at the Windows kernel level. Both can be blocked before they succeed.
Why File System Control Stops Post-Compromise Attacks
FileSure operates as a kernel filter driver. It intercepts every file operation — open, read, write, create, delete, rename — before it reaches the file system. You define policies: which users, which programs, which machines can perform which operations on which files.
When an attacker compromises an RDP session and attempts to deploy ransomware, that ransomware has to write its payload to disk. FileSure blocks that write operation if it comes from an unauthorized program. The payload never lands. The encryption phase never starts.
When an attacker attempts to copy patient records for exfiltration, that operation requires reading PHI files. FileSure blocks unauthorized programs from reading files in your patient data directories. The data never gets copied to a staging location. The exfiltration fails.
This works on legacy Windows systems — the medical imaging workstations, laboratory equipment, and pharmacy systems that can’t run modern endpoint tools because they’re locked to older Windows versions. FileSure installs on all of them.
A Specific FileSure Rule for Healthcare RDP Environments
Here’s a real configuration that blocks ransomware write operations and PHI exfiltration on systems accessible via RDP:
File filter: C:\PatientData\* (or wherever your EHR, PACS, lab results are stored)
Allowed programs: EHR.exe, PACSViewer.exe, LabSystem.exe (your authorized healthcare applications)
Blocked programs: * (everything else)
Operations controlled: Read, Write, Create, Delete
Result: Only your authorized healthcare applications can touch patient data files. Ransomware can’t encrypt them. Unauthorized programs can’t copy them. Every attempt is blocked and logged with user, program, timestamp, and machine name — your HIPAA audit trail is automatic.
RDP might be the front door. But if attackers can’t write ransomware or read patient files once they’re inside, the breach stops there.
Start a free 21-day trial at bystorm.com and see how file system control works on your actual environment — including the legacy systems you can’t replace.
Source: Remote Desktop Tools are the Front Door in Healthcare, and Hackers are Walking Through
Category: Ransomware
Tags: rdp, remote desktop, healthcare security, phi protection, hipaa, kernel filter driver, file system security, legacy medical systems
