The recent data breach at Change Healthcare calls to mind the famous bank robber Willie Sutton, a.k.a. “Willie The Actor,” known for disguising himself a messenger, window cleaner, or bank guard.
In a document received at RACmonitor titled #StopRansomeware: ALPHV Blackcat, penned by what is being called a joint Cybersecurity Advisory (CSA), the authors describe in military terms how Blackcat actors pose as company IT or helpdesk staff, using phone calls or text messages to obtain credentials from employees in order to gain access to the intended network.
According to the document, the ALPHV Blackcat affiliates also are known to use other software to “live-chat” with victims to “convey demands and initiate processes to restore the victims’ encrypted files.”
The Feb. 21 data breach at Change Healthcare – now owned by UnitedHealth Group – was reported to have raised havoc among doctors, pharmacies, and hospitals, as well as patients.
Among other actions taken by the U.S. Department of Health and Human Services (HHS) was the temporary waiving of prior authorizations, and allowing Medicare contractors to accept paper bills from hospitals and physicians.
According to media reports, Change Healthcare – acting as a clearinghouse that connects physicians, pharmacies, and hospitals to insurers for the payment of medical services – is purported to process 15 billion healthcare transactions annually.
According to the CSA, ALPHV Blackcat affiliates “have extensive networks and experience with ransomware and other data extortion operations.”
News reports also confirm that UnitedHealth Group said the ransomware attack was, in fact, attributed to ALPHV Blackcat.
After gaining access to the victim’s network, the bad actors deploy access software in preparation of data exfiltration. They are also known to create user accounts for domain access.
According to the CSA, the bad actors are known to also use legitimate remote access and tunneling tools, such as Plink and Ngrok. The CSA also notes that ALPHV Blackcat affiliates claim to use Brute Ratel C4 (S1063) and Cobalt Strike as beacons to control servers.
Then, during the attack, according to the CSA, ALPHV Blackcat affiliates use the open-source adversary-in-the-middle attack framework Evilginx2, which allows them to obtain multifactor authentication (MFA) credentials, login credentials, and session cookies. The actors also obtain passwords from the domain controller, local network, and deleted backup servers to march
laterally throughout the network.
According to CSA, to evade detection, they employ listed applications such as Metasploit. Once installed on the domain controller, the logs are cleared on the exchange server. Then Mega.nz or Dropbox are used to move, exfiltrate, and/or download victim data. The ransomware is then deployed, and the ransom note is embedded as a file.txt. According to public reporting, affiliates have additionally used POORTRY and STONESTOP to terminate security processes.
Some ALPHV Blackcat affiliates exfiltrate data after gaining access and extort victims without deploying ransomware. After exfiltrating and/or encrypting data, ALPHV Blackcat affiliates are known to communicate with victims via TOR, Tox, email, or encrypted applications. The threat actors then delete victim data from the victim’s system.
It’s been reported that ALPHV Blackcat affiliates offer to provide unsolicited cyber remediation advice as an incentive for payment, offering to provide victims with “vulnerability reports” and “security recommendations,” detailing how they penetrated the system and how to prevent future re-victimization upon receipt of ransom payment. The ALPHV Blackcat encryptor results in a file with the following naming convention: RECOVER-(seven-digit extension) FILES.txt.
According to most media accounts, last year approximately one in three Americans were impacted by healthcare data breaches.
And why healthcare?
To quote the notoriously infamous Willie Sutton, when asked why he robbed banks, he is said to have replied, “Because that’s where the money is.”
Combat is often described as hours of boredom intermixed with moments of sheer terror. I fear that that metaphor is increasingly applicable to Medicare enrollment. Few
Let’s start with a recent (U.S. Department of Health and Human Services Office of Inspector General) OIG audit of a Medicare Advantage plan. Now these
Please log in to your account to comment on this article.
Uncover essential coding insights with nationally recognized coding authority Kay Piper, RHIA, CDIP, CCS. Through ICD10monitor’s interactive, on‑demand webcast series, Kay walks you through the AHA’s 2026 ICD‑10‑CM/PCS Quarterly Coding Clinics, translating each update into practical, easy‑to‑apply guidance designed to sharpen precision, ensure compliance, and strengthen day‑to‑day decision‑making. Available shortly after each official release.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s fourth quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s third quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s second quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Federal auditors are intensifying their focus on inpatient psychiatric facilities, using advanced data analytics to spotlight outliers and pursue high‑dollar repayments. In this high‑impact webcast, Michael Calahan, PA, MBA, Compliance Officer and V.P., Hospital & Physician Compliance, breaks down what regulators are really targeting in IPF-PPS admissions, documentation, treatment and discharge planning. Attendees will learn practical steps to tighten processes, avoid common audit triggers and protect reimbursement and reduce the risk of multimillion-dollar repayment demands.
In this timely session, Stacey Shillito, CDIP, CPMA, CCS, CCS-P, CPEDC, COPC, breaks down the complexities of Medical Decision Making (MDM) documentation so providers can confidently capture the true complexity of their care. Attendees will learn practical, efficient strategies to ensure documentation aligns with current E/M guidelines, supports accurate coding, and reduces audit risk, all without adding to charting time.
Join Ronald Hirsch, MD, FACP, CHCQM for The PEPPER Returns – Risk and Opportunity at Your Fingertips, a practical webcast that demystifies the PEPPER and shows you how to turn complex claims data into actionable insights. Dr. Hirsch will explain how to interpret key measures, identify compliance risks, uncover missed revenue opportunities, and understand new updates in the PEPPER, all to help your organization stay ahead of audits and use this powerful data proactively.
Stay ahead of the 2026-2027 audit surge with “Top 10 Audit Targets for 2026-2027 for Hospitals & Physicians: Protect Your Revenue,” a high-impact webcast led by Michael Calahan, PA, MBA. This concise session gives hospitals and physicians clear insight into the most likely federal audit targets, such as E/M services, split/shared and critical care, observation and admissions, device credits, and Two-Midnight Rule changes, and shows how to tighten documentation, coding, and internal processes to reduce denials, recoupments, and penalties. Attendees walk away with practical best practices to protect revenue, strengthen compliance, and better prepare their teams for inevitable audits.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
BLOOM INTO SAVINGS! Get 25% OFF during our spring sale through March 27. Use code SPRING26 at checkout to claim this offer.
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
