The recent data breach at Change Healthcare calls to mind the famous bank robber Willie Sutton, a.k.a. “Willie The Actor,” known for disguising himself a messenger, window cleaner, or bank guard.
In a document received at RACmonitor titled #StopRansomeware: ALPHV Blackcat, penned by what is being called a joint Cybersecurity Advisory (CSA), the authors describe in military terms how Blackcat actors pose as company IT or helpdesk staff, using phone calls or text messages to obtain credentials from employees in order to gain access to the intended network.
According to the document, the ALPHV Blackcat affiliates also are known to use other software to “live-chat” with victims to “convey demands and initiate processes to restore the victims’ encrypted files.”
The Feb. 21 data breach at Change Healthcare – now owned by UnitedHealth Group – was reported to have raised havoc among doctors, pharmacies, and hospitals, as well as patients.
Among other actions taken by the U.S. Department of Health and Human Services (HHS) was the temporary waiving of prior authorizations, and allowing Medicare contractors to accept paper bills from hospitals and physicians.
According to media reports, Change Healthcare – acting as a clearinghouse that connects physicians, pharmacies, and hospitals to insurers for the payment of medical services – is purported to process 15 billion healthcare transactions annually.
According to the CSA, ALPHV Blackcat affiliates “have extensive networks and experience with ransomware and other data extortion operations.”
News reports also confirm that UnitedHealth Group said the ransomware attack was, in fact, attributed to ALPHV Blackcat.
After gaining access to the victim’s network, the bad actors deploy access software in preparation of data exfiltration. They are also known to create user accounts for domain access.
According to the CSA, the bad actors are known to also use legitimate remote access and tunneling tools, such as Plink and Ngrok. The CSA also notes that ALPHV Blackcat affiliates claim to use Brute Ratel C4 (S1063) and Cobalt Strike as beacons to control servers.
Then, during the attack, according to the CSA, ALPHV Blackcat affiliates use the open-source adversary-in-the-middle attack framework Evilginx2, which allows them to obtain multifactor authentication (MFA) credentials, login credentials, and session cookies. The actors also obtain passwords from the domain controller, local network, and deleted backup servers to march
laterally throughout the network.
According to CSA, to evade detection, they employ listed applications such as Metasploit. Once installed on the domain controller, the logs are cleared on the exchange server. Then Mega.nz or Dropbox are used to move, exfiltrate, and/or download victim data. The ransomware is then deployed, and the ransom note is embedded as a file.txt. According to public reporting, affiliates have additionally used POORTRY and STONESTOP to terminate security processes.
Some ALPHV Blackcat affiliates exfiltrate data after gaining access and extort victims without deploying ransomware. After exfiltrating and/or encrypting data, ALPHV Blackcat affiliates are known to communicate with victims via TOR, Tox, email, or encrypted applications. The threat actors then delete victim data from the victim’s system.
It’s been reported that ALPHV Blackcat affiliates offer to provide unsolicited cyber remediation advice as an incentive for payment, offering to provide victims with “vulnerability reports” and “security recommendations,” detailing how they penetrated the system and how to prevent future re-victimization upon receipt of ransom payment. The ALPHV Blackcat encryptor results in a file with the following naming convention: RECOVER-(seven-digit extension) FILES.txt.
According to most media accounts, last year approximately one in three Americans were impacted by healthcare data breaches.
And why healthcare?
To quote the notoriously infamous Willie Sutton, when asked why he robbed banks, he is said to have replied, “Because that’s where the money is.”
Some of you may have noticed that I am not always very nice to some insurance companies. And deservedly so. But I also point out
Election Day finally arrived – however, some physicians may not be celebrating the new 2025 Medicare Physician Fee Schedule (PFS) Final Rule that also arrived.
Please log in to your account to comment on this article.
Optimize your outpatient clinical documentation and gain comprehensive knowledge from foundational practices to advanced technologies, ensuring improved patient care and organizational and financial success. This webcast bundle provides a holistic approach to outpatient CDI, empowering you to implement best practices from the ground up and leverage advanced strategies for superior results. You will gain actionable insights to improve documentation quality, patient care, compliance, and financial outcomes.
Enhancing outpatient clinical documentation is crucial for maintaining accuracy, compliance, and proper reimbursement in today’s complex healthcare environment. This webcast, presented by industry expert Angela Comfort, DBA, RHIA, CDIP, CCS, CCS-P, will provide you with actionable strategies to tackle complex challenges in outpatient documentation. You’ll learn how to craft detailed clinical narratives, utilize advanced EHR features, and implement accurate risk adjustment and HCC coding. The session also covers essential regulatory updates to keep your documentation practices compliant. Join us to gain the tools you need to improve documentation quality, support better patient care, and ensure financial integrity.
This webcast, presented by Angela Comfort, DBA, RHIA, CDIP, CCS, CCS-P, a recognized expert with over 30 years of experience, offers essential strategies to improve outpatient clinical documentation integrity. You will learn how to enhance the accuracy and completeness of patient records by adopting best practices in coding and incorporating Social Determinants of Health (SDOH). The session also highlights the role of technology, such as EHRs and CDI software, in improving documentation quality. By attending, you will gain practical insights into ensuring precise and compliant documentation, supporting patient care, and optimizing reimbursement. This webcast is crucial for those looking to address documentation gaps and elevate their coding practices.
ICD10monitor has teamed up with renowned CDI expert Dr. Erica Remer to bring you an exclusive webcast on how to recognize sepsis, how to get providers to give documentation that will support sepsis, and how to educate to avert sepsis denials. Register now and become a crucial piece of the solution to standardizing sepsis clinical practice, documentation, and coding at your facility.
Dr. Ronald Hirsch provides critical details on the new Medicare Appeal Process for Status Changes for patients whose status changes during their hospital stay. He also delves into other scenarios of hospital patients receiving custodial care or medically unnecessary services where patient notifications may be needed along with the processes necessary to ensure compliance with state and federal guidance.
Healthcare organizations face complex regulatory requirements under the No Surprises Act and Price Transparency rules. These policies mandate extensive fee disclosures across settings, and confusion is widespread—many hospitals remain unaware they must post every contracted rate. Non-compliance could lead to costly penalties, financial loss, and legal risks. Join David M. Glaser Esq. as he shows you how to navigate these regulations effectively.
Protect your facility from unwanted audits! Join Becky Jacobsen, BSN, RN, MBS, CCS-P, CPC, CPEDC, CBCS, CEMC, and take a deep dive into both the CMS and AMA guidelines for reporting post operative pain blocks. You’ll learn how to determine if the nerve block is separately codable with real life examples for better understanding. Becky will also cover how to evaluate whether documentation supports medical necessity, offer recommendations for stronger documentation practices, and provide guidance on educating providers about documentation requirements. She’ll include a discussion of appropriate modifier and diagnosis coding assignment so that you can be confident that your billing of post operative pain blocks is fully supported and compliant.
During this RACmonitor webcast Dr. Ronald Hirsch spotlights the areas of the OIG’s Work Plan and the findings of their most recent audits that impact utilization review, case management, and audit staff. He also provides his common-sense interpretation of the prevailing regulations related to those target issues. You’ll walk away better equipped with strategies to put in place immediately to reduce your risk of paybacks, increased scrutiny, and criminal penalties.
Copyright © 2024 RACmonitor. Powered by MedLearn Media.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
👻Spooky Sale is Back!👻 Get 31% off all three Medlearn brands, using code SPOOKY24.
