Ransomware Simulation for Hospitals

Ask any hospital board what keeps them up at night and ransomware is at or near the top of the list. The fear is well founded. A ransomware event in a health system is not just an IT outage, it can divert ambulances, delay surgeries, knock out imaging, and put patient safety directly at risk. Yet most hospitals have never actually tested whether they could detect and stop a real ransomware operator moving through their network, because the one thing they cannot afford is to take clinical systems down to find out.

That is the gap healthcare ransomware penetration testing is built to close. At Redfox Cybersecurity, we emulate the behavior of real ransomware crews, from the first phishing email through lateral movement toward imaging systems and domain controllers, and we do it without encrypting a single production file or interrupting patient care. This article explains how that works, why it is different from a standard penetration test, and what a hospital actually learns from it.

Why Hospitals Are Such Attractive Ransomware Targets

Attackers follow leverage, and hospitals offer more of it than almost any other sector. Three factors combine to make healthcare a favored target. First, downtime has immediate human consequences, which raises the pressure to pay quickly. Second, clinical environments are sprawling and heterogeneous, with legacy operating systems, specialized medical devices that cannot be patched on a normal cycle, and flat networks that let an intruder roam. Third, the data itself is valuable, since a full medical record sells for far more than a credit card number and cannot be reissued like one.

On top of that, many health systems have grown through acquisition, inheriting networks, domains, and administrative practices that were never fully integrated or hardened. Each merger tends to widen the attack surface and add trust relationships that an operator can abuse. Understanding these structural weaknesses is the starting point for any serious readiness exercise, because they are exactly the conditions a real crew counts on.

Why a Traditional Pentest Is Not a Ransomware Readiness Test

A traditional penetration test answers the question "can someone break in?" It finds exploitable vulnerabilities, misconfigurations, and weak credentials, and it is genuinely useful. But a ransomware operator's success does not depend on a single clever exploit. It depends on a chain of ordinary steps: a user clicks a link, a foothold is established, credentials are harvested, the attacker moves sideways until they reach something that matters, and then they deploy encryption everywhere at once.

Ransomware readiness is about that chain, and specifically about two things a vulnerability-focused pentest rarely measures:

• Detection and response: how far can an intruder travel before your tools and your team notice, and how fast can you contain them?
• Blast radius: if one laptop is compromised, how much of the environment, including imaging and backups, can be reached from there?

Those are the questions a hospital board is really asking. Answering them takes adversary emulation, not just vulnerability hunting. If your last assessment produced a list of CVEs but never tested whether your team would catch an intruder before they reached the domain controller, our healthcare penetration testing team can help you measure the part that matters most.

What Healthcare Ransomware Penetration Testing Actually Measures

Ransomware emulation, sometimes called adversary emulation or a red team engagement, replicates the tactics, techniques, and procedures (TTPs) of the groups most active against healthcare, without their payload. We follow the same playbook a real crew would, mapped to the MITRE ATT&CK framework, and measure your people, processes, and technology against it.

The outcomes we report on

• Dwell time: how long emulated activity ran before detection, if it was detected at all.
• Reachability: which critical systems, including the picture archiving and communication system (PACS), the EHR, and backup infrastructure, were reachable from a realistic starting point.
• Containment: whether existing controls would have stopped or slowed deployment of ransomware across the estate.
• Response quality: how the security team, help desk, and clinical operations reacted to the signals we generated.

The deliverable is not "here are ten vulnerabilities." It is "here is exactly how far an attacker gets, here is where your detection broke down, and here is what to fix first."

How We Emulate Ransomware Without Disrupting Patient Care

This is the question every hospital asks first, and rightly so. The entire engagement is designed around a simple rule: never do anything that could affect clinical availability or patient data integrity. We achieve that through a safety model agreed before any testing begins.

The non-disruption controls

• No real encryption, ever. Where a real crew would deploy an encryptor, we instead place a harmless marker file, or log that we had the access and capability to do so. The proof is the access, not the damage.
• Clinical systems are handled with care. Life-critical and patient-connected systems are flagged in advance. We demonstrate reachability to them without interacting in any way that could affect their operation.
• Rules of engagement and a kill switch. A signed scope defines allowed actions, blackout windows around critical clinical operations, and a named contact who can halt the exercise instantly.
• Controlled tooling. We use professional adversary-emulation and command-and-control frameworks configured for safety, with activity logged and reversible, rather than live malware.
• Backups are proven reachable, not destroyed. We show that an attacker could have reached and tampered with backups, which is the step that turns an incident into a catastrophe, without altering a single backup.

In practice this means the hospital gets the full strategic picture of a ransomware attack with none of the operational risk. The encryption step, the one thing that causes harm, is always simulated.

Our Ransomware Emulation Methodology, Phase by Phase

We structure engagements around the stages a real healthcare-focused ransomware operation follows. Each phase is mapped to MITRE ATT&CK so your defenders can trace exactly what we did and where they did or did not see it.

Phase 1: Initial access through phishing emulation

Most healthcare ransomware incidents begin with a person, not a server. With your authorization, we run a controlled phishing campaign against an agreed group of users, designed to obtain a foothold the way a real operator would, through a credential capture or a benign simulated payload that calls back to our infrastructure. The goal is not to shame employees. It is to measure how initial access happens in your environment and whether your email security and endpoint tooling catch it. We report click rates, submission rates, and crucially whether the foothold was detected.

Phase 2: Establishing a foothold and discovery

Once we have a simulated foothold, we behave like an operator getting their bearings: enumerating the local system, mapping reachable network segments, and looking for the paths that lead toward valuable systems. In many hospital networks, flat segmentation means a single clinical workstation can see far more than it should. This phase measures whether your segmentation and internal monitoring would flag that reconnaissance.

Phase 3: Credential access and lateral movement toward PACS

Ransomware crews move by harvesting credentials and reusing them. We emulate the same behavior using recognized credential-access and lateral-movement techniques, always within scope, to move toward high-value targets. In healthcare, the picture archiving and communication system is a prime objective: it holds imaging data, it is often poorly segmented, and taking it down halts radiology. We demonstrate whether PACS is reachable from a compromised endpoint and map the path we took to get there.

This is exactly the kind of lateral movement that automated scanners miss and that only hands-on emulation reveals. Mapping these paths, and tying each one to a concrete fix such as segmentation or tiered administration, is a core part of our healthcare penetration testing engagements.

Phase 4: Privilege escalation to Domain Admin

The prize in most Windows environments is Domain Admin or an equivalent level of control over Active Directory, because it lets an attacker push ransomware to every joined machine at once. We pursue privilege escalation through the misconfigurations real operators exploit: over-privileged service accounts, weak delegation, credential reuse between tiers, and exposed administrative interfaces. Reaching this level in a test is a serious finding, and it almost always points to Active Directory hygiene issues that are fixable once they are visible.

Phase 5: Targeting backups and demonstrating impact safely

Modern ransomware crews delete or encrypt backups first, so the victim cannot simply restore. We treat backup infrastructure as a key objective and demonstrate whether it is reachable and modifiable from the access we obtained. Then, at the point where a real operator would deploy their encryptor, we stop and simulate: we place benign marker files, record the systems we could have affected, and document the blast radius. No production or backup data is ever encrypted, deleted, or altered.

Mapping the Engagement to MITRE ATT&CK and Detection

Emulation is only useful if your defenders can learn from it. We map every action to the relevant ATT&CK tactic and technique, then run a purple-team style review with your security team so they can check their telemetry against our timeline.

What the detection review covers

• Which of our actions generated alerts, which generated logs but no alerts, and which were invisible.
• Gaps in endpoint detection and response (EDR), SIEM correlation, and email security coverage.
• Opportunities to add high-value detections, for example alerting on anomalous access to PACS or backup systems, or on suspicious privilege escalation in Active Directory.
• Response process gaps, such as unclear escalation paths between the security team and clinical operations.

This turns the exercise from a one-time scare into a concrete detection-engineering roadmap. Because every finding maps to the HIPAA Security Rule requirements for access control, audit controls, and information system activity review, the report also supports your compliance program. We align these findings to Security Rule safeguards as part of HIPAA penetration testing, so one engagement serves both the security team and the compliance team.

What a Hospital Receives From a Ransomware Emulation

The output is written for two audiences at once: the board and the technical team.

For leadership

• A clear narrative of how an attack would unfold, in plain language, with the business and patient-safety impact at each stage.
• A risk rating that reflects reachability of critical systems and backups, not just a vulnerability count.
• A prioritized set of investments that would most reduce ransomware risk.

For the technical team

• A full attack narrative mapped to MITRE ATT&CK, with timestamps.
• Specific misconfigurations and credential issues that enabled each step.
• Detection gaps and recommended detections, ready for your SIEM and EDR.
• Segmentation and Active Directory tiering recommendations to shrink the blast radius.
• A retest to confirm that the priority fixes actually closed the paths we used.

Who Needs Ransomware Readiness Testing, and How Often?

Any health system that runs clinical operations on a network is a target, from large hospital groups to specialty clinics and the medical device and health-tech vendors that serve them. Because environments change constantly, through mergers, new clinical applications, and device rollouts, ransomware readiness is not a one-time exercise.

A practical cadence is an annual full emulation, with a lighter-weight assessment or a focused retest after major changes such as an acquisition, a significant network redesign, or a new EHR or PACS deployment. Health systems that have recently suffered an incident, or that are strengthening posture ahead of a cyber-insurance renewal, often start sooner. Increasingly, insurers themselves ask for evidence of adversary-focused testing before they will write or renew a policy, so a recent emulation report can directly affect both premiums and coverage terms.

Preparing for a Ransomware Emulation Engagement

Getting value from the exercise starts before testing. We help you prepare by:

• Defining objectives with leadership, for example "prove whether an attacker can reach PACS and backups from a phished laptop."
• Agreeing the rules of engagement, blackout windows, and the kill switch contact.
• Identifying life-critical and patient-connected systems to treat with special care.
• Deciding how much the internal security team knows in advance, since testing a blind team also tests your detection and response realistically.

From there, the engagement runs quietly in the background of normal operations. Clinicians see nothing, patients are never affected, and the hospital comes away with an honest, board-ready picture of its ransomware resilience.

Key Takeaways

• Ransomware readiness is about the whole attack chain and your ability to detect and contain it, not just a list of vulnerabilities.
• Healthcare ransomware penetration testing emulates real operator behavior, from phishing to Domain Admin to backup targeting, mapped to MITRE ATT&CK.
• The engagement is designed for zero disruption: no real encryption, clinical systems protected, a signed scope, and an instant kill switch.
• The most valuable findings are reachability of PACS and backups, privilege escalation paths in Active Directory, and the detection gaps along the way.
• The deliverable serves both the board and the technical team, and ties directly to HIPAA Security Rule safeguards.

Hospitals cannot afford to learn how a ransomware attack would play out by living through one. A controlled emulation gives you the same hard knowledge safely, and shows you exactly where to invest before an attacker tests you for free. To find out how far a realistic attack would get in your environment, talk to Redfox Cybersecurity about a ransomware readiness assessment through our healthcare penetration testing and HIPAA penetration testing services.