The recent data breach at Change Healthcare calls to mind the famous bank robber Willie Sutton, a.k.a. “Willie The Actor,” known for disguising himself a messenger, window cleaner, or bank guard.
In a document received at RACmonitor titled #StopRansomeware: ALPHV Blackcat, penned by what is being called a joint Cybersecurity Advisory (CSA), the authors describe in military terms how Blackcat actors pose as company IT or helpdesk staff, using phone calls or text messages to obtain credentials from employees in order to gain access to the intended network.
According to the document, the ALPHV Blackcat affiliates also are known to use other software to “live-chat” with victims to “convey demands and initiate processes to restore the victims’ encrypted files.”
The Feb. 21 data breach at Change Healthcare – now owned by UnitedHealth Group – was reported to have raised havoc among doctors, pharmacies, and hospitals, as well as patients.
Among other actions taken by the U.S. Department of Health and Human Services (HHS) was the temporary waiving of prior authorizations, and allowing Medicare contractors to accept paper bills from hospitals and physicians.
According to media reports, Change Healthcare – acting as a clearinghouse that connects physicians, pharmacies, and hospitals to insurers for the payment of medical services – is purported to process 15 billion healthcare transactions annually.
According to the CSA, ALPHV Blackcat affiliates “have extensive networks and experience with ransomware and other data extortion operations.”
News reports also confirm that UnitedHealth Group said the ransomware attack was, in fact, attributed to ALPHV Blackcat.
After gaining access to the victim’s network, the bad actors deploy access software in preparation of data exfiltration. They are also known to create user accounts for domain access.
According to the CSA, the bad actors are known to also use legitimate remote access and tunneling tools, such as Plink and Ngrok. The CSA also notes that ALPHV Blackcat affiliates claim to use Brute Ratel C4 (S1063) and Cobalt Strike as beacons to control servers.
Then, during the attack, according to the CSA, ALPHV Blackcat affiliates use the open-source adversary-in-the-middle attack framework Evilginx2, which allows them to obtain multifactor authentication (MFA) credentials, login credentials, and session cookies. The actors also obtain passwords from the domain controller, local network, and deleted backup servers to march
laterally throughout the network.
According to CSA, to evade detection, they employ listed applications such as Metasploit. Once installed on the domain controller, the logs are cleared on the exchange server. Then Mega.nz or Dropbox are used to move, exfiltrate, and/or download victim data. The ransomware is then deployed, and the ransom note is embedded as a file.txt. According to public reporting, affiliates have additionally used POORTRY and STONESTOP to terminate security processes.
Some ALPHV Blackcat affiliates exfiltrate data after gaining access and extort victims without deploying ransomware. After exfiltrating and/or encrypting data, ALPHV Blackcat affiliates are known to communicate with victims via TOR, Tox, email, or encrypted applications. The threat actors then delete victim data from the victim’s system.
It’s been reported that ALPHV Blackcat affiliates offer to provide unsolicited cyber remediation advice as an incentive for payment, offering to provide victims with “vulnerability reports” and “security recommendations,” detailing how they penetrated the system and how to prevent future re-victimization upon receipt of ransom payment. The ALPHV Blackcat encryptor results in a file with the following naming convention: RECOVER-(seven-digit extension) FILES.txt.
According to most media accounts, last year approximately one in three Americans were impacted by healthcare data breaches.
And why healthcare?
To quote the notoriously infamous Willie Sutton, when asked why he robbed banks, he is said to have replied, “Because that’s where the money is.”
While attending the Florida Compliance and Privacy Consortium meeting, I was asked an excellent question. What if a patient who is ready for discharge from
We have been talking a lot lately about the malfeasance of Medicare Advantage (MA) plans, and deservedly so. But malfeasance can be a two-way street.
Please log in to your account to comment on this article.
Join Beth Wolf, MD, CPC, CCDS, for an in-depth webcast on the FY2025 spinal fusion MS-DRG updates. Discover key changes in DRG classification, understand impacts on documentation and CMI, and learn strategies to ensure compliance.
Join Angela Comfort, DBA, MBA, RHIA, CDIP, CCS, CCS-P, as she presents effective strategies to strengthen collaboration between CDI, coding, and quality departments in acute care hospitals. Angela will also share guidance on implementing cross-departmental meetings, using shared KPIs, and engaging leadership to foster a culture of collaboration. Attendees will gain actionable tools to optimize documentation accuracy, elevate quality metrics, and drive a unified approach to healthcare goals, ultimately enhancing both patient outcomes and organizational performance.
Optimize your outpatient clinical documentation and gain comprehensive knowledge from foundational practices to advanced technologies, ensuring improved patient care and organizational and financial success. This webcast bundle provides a holistic approach to outpatient CDI, empowering you to implement best practices from the ground up and leverage advanced strategies for superior results. You will gain actionable insights to improve documentation quality, patient care, compliance, and financial outcomes.
Enhancing outpatient clinical documentation is crucial for maintaining accuracy, compliance, and proper reimbursement in today’s complex healthcare environment. This webcast, presented by industry expert Angela Comfort, DBA, RHIA, CDIP, CCS, CCS-P, will provide you with actionable strategies to tackle complex challenges in outpatient documentation. You’ll learn how to craft detailed clinical narratives, utilize advanced EHR features, and implement accurate risk adjustment and HCC coding. The session also covers essential regulatory updates to keep your documentation practices compliant. Join us to gain the tools you need to improve documentation quality, support better patient care, and ensure financial integrity.
Dr. Ronald Hirsch provides critical details on the new Medicare Appeal Process for Status Changes for patients whose status changes during their hospital stay. He also delves into other scenarios of hospital patients receiving custodial care or medically unnecessary services where patient notifications may be needed along with the processes necessary to ensure compliance with state and federal guidance.
Healthcare organizations face complex regulatory requirements under the No Surprises Act and Price Transparency rules. These policies mandate extensive fee disclosures across settings, and confusion is widespread—many hospitals remain unaware they must post every contracted rate. Non-compliance could lead to costly penalties, financial loss, and legal risks. Join David M. Glaser Esq. as he shows you how to navigate these regulations effectively.
Protect your facility from unwanted audits! Join Becky Jacobsen, BSN, RN, MBS, CCS-P, CPC, CPEDC, CBCS, CEMC, and take a deep dive into both the CMS and AMA guidelines for reporting post operative pain blocks. You’ll learn how to determine if the nerve block is separately codable with real life examples for better understanding. Becky will also cover how to evaluate whether documentation supports medical necessity, offer recommendations for stronger documentation practices, and provide guidance on educating providers about documentation requirements. She’ll include a discussion of appropriate modifier and diagnosis coding assignment so that you can be confident that your billing of post operative pain blocks is fully supported and compliant.
During this RACmonitor webcast Dr. Ronald Hirsch spotlights the areas of the OIG’s Work Plan and the findings of their most recent audits that impact utilization review, case management, and audit staff. He also provides his common-sense interpretation of the prevailing regulations related to those target issues. You’ll walk away better equipped with strategies to put in place immediately to reduce your risk of paybacks, increased scrutiny, and criminal penalties.
Copyright © 2024 RACmonitor. Powered by MedLearn Media.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
