Web Server - actions to perform
1. Stop sshd, vncserver, and vsftpd because they are actively connected to 36.220.4.27 (SSH, VNC, FTP) - a high-confidence, high-frequency attacker that specifically targets the healthcare sector.
2. Stop the HTTPS process (usually httpd or a downloader such as wget/curl) that is talking to
52.104.29.42 and 66.101.22.80, both flagged with high confidence in today's feed.
3. Remove any files those services dropped (check /tmp, /var/www/html/, and users' home directories) to eliminate footholds left by the attacker.
Web Server
36.220.4.27, 52.104.29.42, and 66.101.22.80 all appear in the current high-fidelity feed with Confidence = High; terminating only the services that are communicating with these specific IPs cleanly severs the malicious channels without interrupting unrelated functionality.
EMR Server - actions to perform
4. Stop the MSSQL client service (process name typically sqlcmd or isql) that is connected to
76.17.89.65 - the only high-confidence MSSQL threat in the feeds.
5. Stop sshd, vncserver, and vsftpd if they are reaching 36.220.4.27 (same healthcare-focused attacker as above).
6. Delete any artifacts those processes created in /opt/mssql/, /tmp, or a user's home directory.
EMR Server
76.17.89.65 (High confidence, MSSQL) and 36.220.4.27 (High confidence, multi-protocol) represent the only current high-fidelity threats relevant to an EMR system. Disabling just the affected services and purging their dropped files removes the compromise while leaving essential EMR functions intact.