Patient Zero

SEAN: On one end, there are all of these medical, former medical buildings, including a giant hospital where they isolated tuberculosis patients. So big, brick, stately building. And then on the other side of the island, there's smaller wooden buildings that are crushed.

Patient Zero

JAD: This is from a 60 Minutes special in 1988. That year a reporter named Randy Shilts had written a book called And The Band Played On that for the first time revealed the identity of patient zero.

CARL ZIMMER: It was a -- it was a very potent story. There's no doubt. And -- and he gave HIV to a lot of people, there's no question about that. But what we do know is that he was not patient zero.

CARL ZIMMER: It's been there the longest. It's had the longest time to become diverse, to mutate, to evolve. So if you want to really -- if you want to get to the real patient zero as it were, the most interesting stuff come -- actually comes from Africa. So one way to try to figure out its origins there is to go looking for the virus.

DAVID QUAMMEN: If we had to guess? If we had to guess, that human was probably a Bantu man living very near the forest or in the forest in southeastern Cameroon. He was hunting. Maybe he had a bow and arrow, maybe he had a spear, and he kills a chimpanzee. Bingo here's a big pile of meat. And he starts to butcher it. He's cutting open the chest cavity. He's pulling out organs and he cuts himself. And he gets blood-to-blood contact. Chimpanzee blood against his blood. What happens is that the virus in the chimpanzee blood found itself in an environment that was unexpected, that was alien to it, but was not too much different from the biochemical environment it had been in, chimpanzee blood. It could function. And that's the moment. That's the moment it begins. That human is patient zero.

JAD: The chimps are literally covered in blood. They have blood on their face, in their eyes. And from the virus's perspective, this is spillover heaven. Okay. So the following is the closest that we can get to a zero point in this entire narrative. We don't know where it happened.

JAD: From the molecular clock, we know it was less than a million years. That's all we know. But whenever it was, chimp zero was hunting and it comes upon a monkey called a red-capped mangabey.

JAD: Chimp zero spots one of these monkeys, eats it. And in the process, he catches a red-capped mangabey version of the AIDS virus. Next, sometime after that first kill, weeks, months, we don't know maybe it was the same day, chimp zero comes across another monkey. And this monkey was called a spot-nosed guenon.

NATHAN WOLFE: Yes. So if you want a patient zero, really clear patient zero, it's some of these individuals that have been infected with these viruses. And the real question is, how do we stop patient zeros? How do we avoid patient ...

DAVID QUAMMEN: Yeah, they've looked in lots -- they've looked in all kinds of animals. They've looked in insects. They've looked in snakes. They've looked in forest antelopes. They've looked in monkeys. They looked in plants. Literally hundreds of different species they looked in. Found zero traces of live Ebola virus.

"Gaétan Dugas is one of the most demonised patients in history, and one of a long line of individuals and groups vilified in the belief that they somehow fuelled epidemics with malicious intent," says McKay.

While his wider research traces this impulse to blame back several centuries, for the Nature paper McKay located the immediate roots of the term "Patient Zero" in an early 'cluster study' of US AIDS patients.

CDC investigators employed a coding system to identify the study's patients, numbering each city's cases linked to the cluster in the sequence their symptoms appeared (LA 1, LA 2, NY 1, NY 2, etc.). However, within the CDC, Case 057 became known as 'Out(side)-of-California' -- his new nickname abbreviated with the letter 'O.'

In the spring of 1982, epidemic intelligence officers were almost a year into a troubling investigation. Residents of three major American cities, mostly gay men, were dying young and no one knew why. A handful of researchers from the Centers for Disease Control and Prevention were tasked with traveling the country to interview patients and spot patterns.

In the case of our patient zero, we will focus on the first step - the initial compromise - which is usually performed using social engineering and spear phishing over email (with a zero-day malicious attachment) or a website that employees of the target organisation are likely to visit.

In the physical world, the first thing researchers look for during an outbreak is patient zero. Where did the virus start and where are all of the places and who are all of the people it could have touched? In the cyber world this almost never happens. But it is just as fundamental.

Visibility to identify who was infected first, the application that introduced the malware and the files that are causing it to spread enables us to address the infection at the root and avoid re-infection. Identifying the last patient is equally important as we can define the scope of the infection, assess the risk and understand what it will take to control the outbreak.

Organizations have more problems than hands. By automating many of the steps of dealing with infections and gaining control over their own environments, organizations can improve protection and reduce their malware costs dramatically. It begins with the important first step of identifying patient zero.

This article contextualizes the production and reception of And the Band Played On, Randy Shilts's popular history of the initial recognition of the American AIDS epidemic. Published over twenty-five years ago, the book and its most notorious character, "Patient Zero," are in particular need of a critical historical treatment. The article presents a more balanced consideration-a "patient's view"-of Gaétan Dugas's experience of the early years of AIDS. I oppose the assertion that Dugas, the so-called Patient Zero, ignored incontrovertible information about the condition and was intent on spreading his infection. Instead I argue that scientific ideas in 1982 and 1983 about AIDS and the transmissibility of a causative agent were later portrayed to be more self-evident than they were at the time. The article also traces how Shilts's highly selective-and highly readable-characterization of Dugas rapidly became embedded in discussions about the need to criminalize the reckless transmission of HIV.

Our inline analyzers and machine learning techniques detected and blocked more than 500,000 patient zero URLs and about 200,000 malicious scanning requests in June-September. In this blog, we describe examples of the most noticeable campaigns from that data set and the types of stealthy techniques they use. We observe examples of malware delivery, command-and-control (C2) URLs, phishing links and grayware scams. The inline vantage point also gives us the ability to detect malicious scanning activity and attacking requests.

Palo Alto Networks Next-Generation Firewall customers with Advanced URL Filtering are protected against patient zero malicious campaigns similar to the ones described in this blog. All the mentioned malicious indicators (domains, IPs, URLs and hashes) are also covered by DNS Security and WildFire products.

To evaluate the patient-zero prevention efficacy of our techniques against ransomware, we tested the real-time analyzers in Advanced URL Filtering against all URLs observed delivering ransomware from January 2021 to August 2021. The result shows that the real-time analyzers in Advanced URL Filtering are capable of blocking 29.18% of these ransomware URLs. Those URLs cover 29.6% of all ransomware samples we collected during this period.

This can be addressed by adding inline detection against these patient zero threats, especially to protect against rapidly varying malicious child URLs produced via abusing a web or file hosting service. For example, Advanced URL Filtering uses this technique to detect more than 100 compromised or abused websites daily on average. The following shows two examples of abusing 000webhost and Discord URLs.

Here, we presented the example of Advanced URL Filtering. Powered by machine learning and the work of Unit 42 researchers, the inline analyzers used in the product have detected and blocked hundreds of thousands of patient zero URLs since release.

"Patient zero" may denote the first person to be diagnosed with a virus within a certain population, the first person in a medical study, or the first person to receive a certain kind of treatment. It is sometimes used to refer to inanimate objects, like computers, or people at the center of a new trend.

As a transgender man who has also written about his own experiences, Bakker is a sympathetic historian. Reached by email shortly after the publication of the New York Times letter, he tells Reason: "Framing the term 'patient zero' as 'a phrase that vilifies transness as a disease to be feared' seems to me to be a rhetorical choice, not an established fact."

For many years, one man was named patient zero and incorrectly blamed for spreading HIV across the United States. However, more recent evidence has determined that HIV was present in the U.S. before this time. This individual was simply one of the thousands who contracted the virus early on in the epidemic.

The first verified case of HIV derives from a 1959 blood sample of an individual who lived in the Democratic Republic of Congo. However, scientists cannot say whether this person was the first human with HIV, or the first documented case, known as patient zero. 041b061a72