Data Hack Harkens Back to Bank Robberies

EDITOR’S NOTE: The recent data breach at Change Healthcare calls to mind the famous bank robber Willie Sutton, a.k.a. “Willie The Actor,” known for disguising himself a messenger, window cleaner, or bank guard.

In a document received at ICD10monitor titled #StopRansomeware: ALPHV Blackcat, penned by what is being called a joint Cybersecurity Advisory (CSA), the authors describe in military terms how Blackcat actors pose as company IT or helpdesk staff, using phone calls or text messages to obtain credentials from employees in order to gain access to the intended network.

According to the document, the ALPHV Blackcat affiliates also are known to use other software to “live-chat” with victims to “convey demands and initiate processes to restore the victims’ encrypted files.”

The Feb. 21 data breach at Change Healthcare – now owned by UnitedHealth Group – was reported to have raised havoc among doctors, pharmacies, and hospitals, as well as patients.

Among other actions taken by the U.S. Department of Health and Human Services (HHS) was the temporary waiving of prior authorizations, and allowing Medicare contractors to accept paper bills from hospitals and physicians.

According to media reports, Change Healthcare – acting as a clearinghouse that connects physicians, pharmacies, and hospitals to insurers for the payment of medical services – is purported to process 15 billion healthcare transactions annually.  

According to the CSA, ALPHV Blackcat affiliates “have extensive networks and experience with ransomware and other data extortion operations.”

News reports also confirm that UnitedHealth Group said the ransomware attack was, in fact, attributed to ALPHV Blackcat.

After gaining access to the victim’s network, the bad actors deploy access software in preparation of data exfiltration. They are also known to create user accounts for domain access.

According to the CSA, the bad actors are known to also use legitimate remote access and tunneling tools, such as Plink and Ngrok. The CSA also notes that ALPHV Blackcat affiliates claim to use Brute Ratel C4 (S1063) and Cobalt Strike as beacons to control servers.

Then, during the attack, according to the CSA, ALPHV Blackcat affiliates use the open-source adversary-in-the-middle attack framework Evilginx2, which allows them to obtain multifactor authentication (MFA) credentials, login credentials, and session cookies. The actors also obtain passwords from the domain controller, local network, and deleted backup servers to march laterally throughout the network.

According to CSA, to evade detection, they employ listed applications such as Metasploit. Once installed on the domain controller, the logs are cleared on the exchange server. Then Mega.nz or Dropbox are used to move, exfiltrate, and/or download victim data. The ransomware is then deployed, and the ransom note is embedded as a file.txt. According to public reporting, affiliates have additionally used POORTRY and STONESTOP to terminate security processes.

Some ALPHV Blackcat affiliates exfiltrate data after gaining access and extort victims without deploying ransomware. After exfiltrating and/or encrypting data, ALPHV Blackcat affiliates are known to communicate with victims via TOR, Tox, email, or encrypted applications. The threat actors then delete victim data from the victim’s system.

It’s been reported that ALPHV Blackcat affiliates offer to provide unsolicited cyber remediation advice as an incentive for payment, offering to provide victims with “vulnerability reports” and “security recommendations,” detailing how they penetrated the system and how to prevent future re-victimization upon receipt of ransom payment. The ALPHV Blackcat encryptor results in a file with the following naming convention: RECOVER-(seven-digit extension) FILES.txt.

According to most media accounts, last year approximately one in three Americans were impacted by healthcare data breaches.

And why healthcare?

To quote the notoriously infamous Willie Sutton, when asked why he robbed banks, he is said to have replied, “Because that’s where the money is.”