(Credit: Getty Images)
The notorious ALPHV/Blackcat ransomware group has rebounded from an FBI takedown and attacked a growing number of healthcare providers.
On Tuesday, the FBI and US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert about the return of the ransomware group after federal agents seized the gang’s websites and servers back in December.
“Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most commonly victimized,” the federal agencies wrote in the warning. “This is likely in response to the ALPHV Blackcat administrator’s post encouraging its affiliates to target hospitals after operational action against the group and its infrastructure in early December 2023.”
In other words, it looks like ALPHV is trying to exact revenge by hitting US critical infrastructure. The FBI issued the alert as a cyberattack on Change Healthcare has been preventing pharmacies across the US from processing prescriptions. According to Reuters, the attack on Change Healthcare has since been linked to the ALPHV/Blackcat group.
The group’s return suggests that FBI efforts to disrupt ransomware actors by taking down their server infrastructure won’t be enough to stop the threat. Last week, international law enforcement dealt a similar blow against a separate ransomware group called Lockbit, hijacking its servers. But even so, the gang is already preparing to make a comeback.
It doesn’t help that many ransomware hackers appear to be based in Russia, a country that refuses to extradite suspected cybercriminals to the US. In the meantime, the FBI is warning that ALPHV has been hacking companies by impersonating IT helpdesk staff and tricking employees into giving up their login credentials. The group also might be exploiting a new vulnerability in ConnectWise’s Screenconnect software to break into company networks.
So far, Change Healthcare’s parent, UnitedHealth Group, hasn’t confirmed whether ALPHV was responsible for the cyberattack. But the company tells PCMag: “We estimate more than 90% of the nation’s 70,000+ pharmacies have modified electronic claim processing to mitigate impacts from the Change Healthcare cyber security issue; the remainder have offline processing workarounds.”
Meanwhile, ALPHV has been spotted posting on its own website, claiming responsibility for the attack on Change Healthcare.