Banks and Medical Institutions Prime Targets for Sorry Ransomware: How All-Optical Networks Strengthen Cybersecurity

In March 2026, Hancock Regional Hospital in Indiana, USA, suffered a ransomware attack. Hackers accessed the hospital’s remote access portal using third-party vendor credentials, compromised email systems, electronic health records and internal operating systems, locked over 1,400 files, and appended the suffix "I'm sorry" to all filenames. The hospital was forced to pay a Bitcoin ransom of $55,000 to regain system control.

This is not a scene from a science fiction movie, but an authentic threat spreading globally. The National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention jointly issued a security alert: multiple "Sorry" ransomware attack cases have been detected in China. Financial institutions including banks and medical organizations are top targets for attackers.

I. How Dangerous Is the "Sorry" Ransomware?

Stealth Intrusion Without User Clicks

Traditional ransomware relies on tricking users into clicking links or downloading attachments, yet the "Sorry" ransomware works in an entirely different way. It exploits a cPanel authorization vulnerability (CVE-2026-41940) to directly obtain server administrative privileges. In interviews with cybersecurity experts, professionals stated clearly: “Unlike most previous ransomware variants that require users to actively install malicious programs, this ransomware logs into servers directly via system vulnerabilities, and the intrusion remains completely invisible to users.”

Data Theft First, Encryption Second, Followed by Ransom Demands

Ransomware has evolved from simple file encryption into a dual attack model: data exfiltration + encrypted extortion. The "Sorry" ransomware carries out attacks in six phases: exploiting the cPanel vulnerability to gain access, exfiltrating victim data, terminating backup and security services, stealing sensitive information, encrypting files with AES+RSA algorithms, and scanning for weak SSH passwords to achieve lateral intranet spread.

More critically, it adopts a combined symmetric and asymmetric encryption mechanism. The malware randomly generates a symmetric key to encrypt files, while the decryption private key is held exclusively by attackers. Even if cybersecurity analysts obtain the complete malware sample for line-by-line reverse engineering, the decryption key cannot be retrieved. Without a valid decryption key, there is currently no reliable way to recover encrypted data.

Lateral Movement Within the Intranet: One Compromised Host Risks the Entire Network

After a successful intrusion, the malware attempts to access other devices on the server’s internal network. This means a single breached server may compromise the whole intranet.

II. Why Are Banks and Medical Institutions Prime Targets?

Bai Jun, member of the Cybersecurity Special Committee of the China Computer Federation, analyzed in a CCTV interview: “Whoever owns high-value data and cannot afford business downtime becomes a target.” Banks and medical institutions perfectly fit both criteria.

• Extremely high data value: Banks store customer account information, transaction records and credit data; medical institutions retain patient medical histories, diagnosis records and health archives. Such data fetches far higher prices on the dark web than data from ordinary enterprises. Since the "Sorry" ransomware steals data before encryption, backups alone cannot prevent sensitive data from being exposed publicly.
• Huge costs of business disruption: A few minutes of outage for a bank’s core trading system may cause millions in losses and regulatory accountability; failure of a hospital HIS system directly disrupts patient treatment. In the first half of 2026, global ransomware extortion cases rose 25% year-on-year to 4,544 incidents. Ransom attacks have shifted from occasional emergencies to daily threats.
• Inadequate defense across extensive networks: Banks and medical institutions operate numerous branches. Cybersecurity maturity varies widely across outlets, branch hospitals and community clinics, which often become attack entry points.

III. Why Conventional Security Solutions Fail to Provide Adequate Protection

Endpoint Antivirus: Malware Disables Security Tools Prior to Encryption

After infiltration, the "Sorry" ransomware first terminates security protection, backup and related services. Traditional endpoint antivirus software is shut down before malware execution, leaving no time to respond.

Perimeter Firewalls: Visible External Traffic, Blind to Internal Lateral Movement

Most conventional firewalls focus on perimeter defense and lack effective governance for internal east-west traffic. Once inside the intranet, the "Sorry" ransomware spreads through SSH ports. This internal-to-internal traffic is allowed by default on firewalls.

Absence of Network Segmentation: One Breach Compromises the Entire Network

Branch networks of banks and medical organizations often lack granular security isolation. Different departments and business systems share the same network segment. Malware can move laterally via protocols such as SSH. Once an office terminal is compromised, ransomware can directly reach core business servers.

IV. How All-Optical Networks Build Strong Defenses for Banks and Medical Institutions

AINOPOL shifts security capabilities from add-on tools to native built-in protection. The multi-service converged gateways of all-optical networks integrate firewalls, AV antivirus engines, IPS intrusion prevention systems and multiple security mechanisms. Against the three major threats posed by the "Sorry" ransomware, the all-optical network delivers multi-layer protection:

Layer 1: Gateway-level AV Engine — Block Malware Before It Enters the Intranet
The all-optical gateway embeds an AV antivirus engine with a signature library of over 200,000 malware entries. It performs real-time scanning of inbound and outbound email attachments, files and downloads, with deep parsing for compressed packages, Office documents and other formats. Regardless of whether endpoints have antivirus software installed, malicious files will be detected before entering the intranet. Ransomware is intercepted at the network perimeter before reaching core trading networks or HIS servers.

Layer 2: IPS Intrusion Prevention — Halt Lateral Propagation
The all-optical gateway features a built-in IPS intrusion prevention system with more than 5,000 signature rules. At key network nodes, it detects and blocks server-targeted attacks including vulnerability scanning, brute-force attacks against weak passwords and abnormal SSH connections. Lateral spread of the "Sorry" ransomware over SSH ports is identified and blocked at the IPS layer.

Layer 3: Logical Segmentation of Business Domains — Prevent Full-Network Collapse from a Single Compromise
Banks’ core trading systems, payment gateways and customer databases, as well as hospitals’ HIS, PACS and EMR systems, must be strictly isolated from office and guest networks. Supported natively by the Dream Gateway M1, AINOPOL all-optical networks adopt VLAN logical isolation, alongside microsegmentation, AI anomaly monitoring and multi-factor access control. Four rigidly separated security domains are deployed for office, production, R&D and IoT scenarios. Even if the office network is breached, attackers cannot access core trading systems or HIS servers.

Faced with compound threats from the "Sorry" ransomware including stealth intrusion, data theft, encryption and intranet spread, passive defense relying on traditional endpoint and perimeter protection can no longer cope effectively. Moving past the drawbacks of stacking discrete security hardware, AINOPOL builds a multi-layer, full-domain security barrier centered on native security capabilities of all-optical networks. The solution precisely meets strict protection requirements for high-sensitivity sectors including banking and healthcare. It blocks malware intrusion and lateral propagation at the source, guards against core data leakage and critical business outages, and consolidates a solid cybersecurity foundation for stable digital operations in key industries such as finance and healthcare.

FAQ

Q: Why are banks and medical institutions particularly targeted by the "Sorry" ransomware?
A: Experts from the China Computer Federation stated in a CCTV interview: “Whoever owns high-value data and cannot afford business downtime becomes a target.” Banks manage customer capital and transaction data, while medical institutions store patient medical records and diagnosis information, both of which carry extremely high value. Business disruptions incur massive costs: minutes of downtime for banking transaction systems result in million-level losses, and HIS outages in hospitals directly interfere with patient care.

Q: What differentiates the "Sorry" ransomware from regular ransomware?
A: Its defining feature is stealth intrusion. Ordinary ransomware requires users to click links or download attachments, while the "Sorry" variant accesses servers directly by exploiting the cPanel vulnerability. More dangerously, it terminates backup services before encryption and steals data prior to extortion. Even with data backups, sensitive information may already have been stolen.

Q: Why can’t deployed firewalls and antivirus software prevent the attack?
A: Endpoint antivirus programs may be shut down before malware executes; perimeter firewalls cannot detect lateral movement inside the network. After infiltrating the intranet, the "Sorry" ransomware spreads via SSH ports, and this internal traffic is allowed by default on firewalls. All-optical networks implement in-depth defense combining gateway-level AV, IPS and business domain isolation.