North Korean APT actors have targeted several United States Healthcare and Public Health (HPH) organizations within the healthcare industry through a string of Maui ransomware attacks. These threat actors have encrypted and exfiltrated information from several organizations’ servers, which contain assets for electronic health record services, diagnostic services, imaging services, and internal networks. By choosing the Maui ransomware variant, threat actors have more control over the behavior of the program with the ability to choose which files and directories are to be ransomed. During the encryption process, Maui will utilize a combination of encryption methods including AES, RSA, and XOR prior to exfiltration of the data. Each file is encrypted with AES-128 with an associated key, which is encrypted by RSA public and private keys, and those keys are encrypted by XOR hard drive encryption. While no one group has been tied to these attacks, analysts from the Federal Bureau of Investigation attribute the attacks to North Korea based on the observed tactics, techniques, and procedures of the threat actors. Indicators of compromise for the Maui ransomware are included in the articles below. CTIX urges security personnel and network administrators to implement security controls to detect ransomware and other malicious programs in order to mitigate the risk of compromise from threat actors.