Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

Unauth DICOM PACS → mass medical-image exfil

PACS server accepts unauthenticated C-FIND / C-MOVE on port 104 / 11112. Query for every study, pull every image — exfil hundreds of thousands of patient scans + DICOM metadata (PII).

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target hospital exposes its PACS to the corporate LAN with default AE titles and no authentication. (Shodan still finds public PACS too.)

§ Steps

  1. 01
    Bulk download to attacker storageExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    C-FIND every patient studyDiscovery
    T1087— Account Discovery
  3. 03
    Find PACS via DICOM port scanDiscovery
    N-NMAP-INTERNAL— Internal Nmap Sweep
  4. 04
    C-MOVE images to attacker SCPCollection
    HC-DICOM-CSTORE— DICOM C-STORE Unauth Access
  5. 05
    DICOM C-ECHO handshakeCollection
    HC-DICOM-CSTORE— DICOM C-STORE Unauth Access

§ References

§ Frequently asked

What is the "Unauth DICOM PACS → mass medical-image exfil" attack path?
PACS server accepts unauthenticated C-FIND / C-MOVE on port 104 / 11112. Query for every study, pull every image — exfil hundreds of thousands of patient scans + DICOM metadata (PII). It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Bulk download to attacker storage (T1041) — a exfiltration primitive. Assumed environment: target hospital exposes its PACS to the corporate LAN with default AE titles and no authentication.
What is the final impact of this kill-chain?
The final step lands on DICOM C-ECHO handshake (HC-DICOM-CSTORE), which falls under Collection. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers