BlackCat Ransomware Group Implodes After Obvious $22M Fee by Change Healthcare – Krebs on Safety

There are indications that U.S. healthcare big Change Healthcare has made a $22 million extortion fee to the notorious BlackCat ransomware group (a.okay.a. “ALPHV“) as the corporate struggles to carry companies again on-line amid a cyberattack that has disrupted prescription drug companies nationwide for weeks. Nevertheless, the cybercriminal who claims to have given BlackCat entry to Change’s community says the crime gang cheated them out of their share of the ransom, and that they nonetheless have the delicate information Change reportedly paid the group to destroy. In the meantime, the affiliate’s disclosure seems to have prompted BlackCat to stop operations solely.

Picture: Varonis.

Within the third week of February, a cyber intrusion at Change Healthcare started shutting down essential healthcare companies as firm methods have been taken offline. It quickly emerged that BlackCat was behind the assault, which has disrupted the delivery of prescription drugs for hospitals and pharmacies nationwide for almost two weeks.

On March 1, a cryptocurrency tackle that safety researchers had already mapped to BlackCat obtained a single transaction value roughly $22 million. On March 3, a BlackCat affiliate posted a grievance to the unique Russian-language ransomware discussion board Ramp saying that Change Healthcare had paid a $22 million ransom for a decryption key, and to forestall 4 terabytes of stolen information from being revealed on-line.

The affiliate claimed BlackCat/ALPHV took the $22 million fee however by no means paid him his proportion of the ransom. BlackCat is called a “ransomware-as-service” collective, that means they depend on freelancers or associates to contaminate new networks with their ransomware. And people associates in flip earn commissions starting from 60 to 90 p.c of any ransom quantity paid.

“However after receiving the fee ALPHV group resolve to droop our account and hold mendacity and delaying once we contacted ALPHV admin,” the affiliate “Notchy” wrote. “Sadly for Change Healthcare, their information [is] nonetheless with us.”

Change Healthcare has neither confirmed nor denied paying, and has responded to a number of media retailers with an identical non-denial assertion — that the corporate is focused on its investigation and on restoring services.

Assuming Change Healthcare did pay to maintain their information from being revealed, that technique appears to have gone awry: Notchy mentioned the checklist of affected Change Healthcare companions they’d stolen delicate information from included Medicare and a bunch of different main insurance coverage and pharmacy networks.

On the brilliant facet, Notchy’s grievance appears to have been the ultimate nail within the coffin for the BlackCat ransomware group, which was infiltrated by the FBI and foreign law enforcement partners in late December 2023. As a part of that motion, the federal government seized the BlackCat web site and launched a decryption instrument to assist victims get well their methods.

BlackCat responded by re-forming, and rising affiliate commissions to as a lot as 90 p.c. The ransomware group additionally declared it was formally eradicating any restrictions or discouragement towards concentrating on hospitals and healthcare suppliers.

Nevertheless, as an alternative of responding that they might compensate and placate Notchy, a consultant for BlackCat mentioned as we speak the group was shutting down and that it had already discovered a purchaser for its ransomware supply code.

The seizure discover now displayed on the BlackCat darknet web site.

“There’s no sense in making excuses,” wrote the RAMP member “Ransom.” “Sure, we knew about the issue, and we have been making an attempt to resolve it. We instructed the affiliate to attend. We might ship you our personal chat logs the place we’re shocked by every little thing that’s taking place and try to resolve the problem with the transactions through the use of a better payment, however there’s no sense in doing that as a result of we determined to totally shut the challenge. We are able to formally state that we bought screwed by the feds.”

BlackCat’s web site now incorporates a seizure discover from the FBI, however a number of researchers famous that this picture appears to have been merely lower and pasted from the discover the FBI left in its December raid of BlackCat’s community. The FBI has not responded to requests for remark.

Fabian Wosar, head of ransomware analysis on the safety agency Emsisoft, mentioned it seems BlackCat leaders try to drag an “exit rip-off” on associates by withholding many ransomware fee commissions directly and shutting down the service.

“ALPHV/BlackCat didn’t get seized,” Wosar wrote on Twitter/X as we speak. “They’re exit scamming their associates. It’s blatantly apparent once you examine the supply code of their new takedown discover.”

Dmitry Smilyanets, a researcher for the safety agency Recorded Future, mentioned BlackCat’s exit rip-off was particularly harmful as a result of the affiliate nonetheless has all of the stolen information, and will nonetheless demand extra fee or leak the data on his personal.

“The associates nonetheless have this information, and so they’re mad they didn’t obtain this cash, Smilyanets told Wired.com. “It’s a great lesson for everybody. You can not belief criminals; their phrase is value nothing.”

BlackCat’s obvious demise comes intently on the heels of the implosion of one other main ransomware group — LockBit, a ransomware gang estimated to have extorted over $120 million in funds from greater than 2,000 victims worldwide. On Feb. 20, LockBit’s web site was seized by the FBI and the U.Okay.’s Nationwide Crime Company (NCA) following a months-long infiltration of the group.

LockBit additionally tried to revive its status on the cybercrime boards by resurrecting itself at a brand new darknet web site, and by threatening to launch information from plenty of main firms that have been hacked by the group within the weeks and days previous to the FBI takedown.

However LockBit seems to have since misplaced any credibility the group might have as soon as had. After a much-promoted assault on the federal government of Fulton County, Ga., for instance, LockBit threatened to launch Fulton County’s information except paid a ransom by Feb. 29. However when Feb. 29 rolled round, LockBit simply deleted the entry for Fulton County from its site, together with these of a number of monetary organizations that had beforehand been extorted by the group.

Fulton County held a press convention to say that it had not paid a ransom to LockBit, nor had anybody accomplished so on their behalf, and that they have been simply as mystified as everybody else as to why LockBit by no means adopted by on its risk to publish the county’s information. Specialists instructed KrebsOnSecurity LockBit seemingly balked as a result of it was bluffing, and that the FBI seemingly relieved them of that information of their raid.

Smilyanets’ feedback are pushed residence in revelations first revealed final month by Recorded Future, which quoted an NCA official as saying LockBit by no means deleted the info after being paid a ransom, regardless that that’s the solely cause a lot of its victims paid.

“If we don’t provide you with decrypters, or we don’t delete your information after fee, then no person pays us sooner or later,” LockBit’s extortion notes sometimes learn.

Hopefully, extra firms are beginning to get the memo that paying cybercrooks to delete stolen data is a dropping proposition throughout.