The ongoing saga of the BlackCat/AlphV ransomware gang continues, with a news report that the crew has shut down its servers after a controversial hack of an American healthcare services provider.
Bleeping Computer says the gang’s data leak blog shut on Friday and the sites it uses to negotiate ransom payments closed today.
This comes after
— a gang affiliate last month was allegedly paid US$22 million after its data theft and ransomware attack disrupted the services of Change Healthcare, which provides a range of services to hospitals and clinics including processing pharmacy prescriptions and healthcare payments;
— on the heels of that incident, the BlackCat/AlphV operators reportedly plucked that payment back from the affiliate’s digital wallet before shutting down operations.
Got it?
Bleeping Computer says it’s unclear whether the closure is an exit scam or an attempt to rebrand the gang under a different name. BlackCat, the news service points out, is a rebrand of the DarkSide ransomware operation.
All this comes after American cyber authorities in December seized several of the group’s data leak and communications sites and published a decrypter that victim organizations can use to get access back to scrambled data.
It isn’t unknown why BlackCat/AlphV operators struck at one of its partners. Because of the December hit, the gang said it removed all of its rules forbidding affiliates allowed to use its ransomware to attack critical infrastructure like the healthcare sector.
In fact, the attack on Change Healthcare appeared to be a sign that BlackCat/AlphV had bounced back from the December blow.
Rick Pollack, CEO of the American Hospitals Association, called it “the most serious incident of its kind levelled against an U.S. healthcare organization.” According to Change Healthcare, he noted, the company processes 15 billion healthcare transactions annually and touches one in every three American patient records.
The incident is serious enough that, according to Politico, the White House’s National Security Council started looking into ways to provide short-term financial relief to U.S. hospitals. Arguably, attention from the White House is not what a ransomware gang wants.
Johannes Ullrich, dean of research at the SANS Technology Institute, a cybersecurity learning site, shrugged. “This is just the ‘usual drama’ for ransomware groups,” he said in an email. “Cheating affiliates out of money, or issues about what targets to attack or not attack are common points of contention. Ransomware actors have made announcements in the past to not attack certain sites, like healthcare, but have hardly ever stuck to these claims. I expect AlphV/Blackcat to come back under a new name soon.”
Brett Callow, a Canadian-based threat researcher at Emsisoft, had no comment on the internal dealings of the gang. But he did say that if Change Healthcare did pay US$22 million for access to stolen data and decryption keys, “it’s very concerning, as it will ensure the health sector will remain a top target for ransomware operators, increasing the probability of further disruptive attacks. Put bluntly, attacks on the health sector cause deaths, and I firmly believe that banning payments is the only way to quickly bring them to an end.”
