Researchers create malware that places fake cancerous nodes in CT scans to fool radiologists, showing what high-profile attacks on hospital gear could look like
Kim Zetter / Washington Post :
Context & Ripple Effects
This 2019 reporting by Kim Zetter moved the hospital-cyberattack conversation beyond lockups and downtime: the demonstrated malware doesn't encrypt imaging systems, it quietly edits what they show, planting fake cancerous nodes in CT scans where a radiologist has no reason to doubt them. It landed the same year researchers showed [[a:943900|AI-based defenses like Cylance's antivirus engine could be tricked into treating real malware as benign]], an early signal that machine-learning pipelines themselves were attackable.
The arc since then has validated the warning. Ransomware crews turned every intrusion into a payday per the evolution of crypto-ransomware, and by 2020 a TrickBot ransomware attack at the University of Vermont Medical Center was delaying treatment and tests for real patients. By 2023, Cisco Talos reported [[a:843502|North Korea's Lazarus group using new malware against internet backbone infrastructure and healthcare entities in Europe and the US]] — state-grade interest in exactly the sector this research flagged.
First-order effects
- Hospitals and radiologists face a threat model where tampered scans are indistinguishable from genuine ones, meaning image integrity — not just system uptime — becomes something clinical staff must be able to trust.
- Medical-device makers and hospital IT teams are directly challenged to add verification and audit trails to imaging workflows that were designed assuming the data is authentic.
Second-order effects
- Ransomware operators gain a template for higher-stakes extortion: if attackers can alter diagnoses rather than merely block access, hospitals face pressure to pay not just to restore systems but to guarantee their outputs were never corrupted.
- Security vendors must extend detection beyond network intrusions to data-manipulation inside clinical software, following the same lesson as the Cylance evasion work that even AI-based defenses need adversarial testing.
Third-order effects
- Healthcare cybersecurity shifts from an availability problem (keep systems running) to an integrity problem (prove the data is true), pushing regulators and device certification regimes toward verifiable provenance for diagnostic output.
- If state groups like Lazarus keep expanding into healthcare infrastructure, nation-state tooling eventually converges with this kind of manipulation capability, making medical imaging a contested target rather than collateral damage.
The trend: Attacks on healthcare are escalating from encrypting records to corrupting the clinical data itself, turning medical AI and imaging pipelines into integrity battlegrounds.