AA24-060A: ALPHV BlackCat Ransomware Deployment Targeting Healthcare Organizations
Key Facts
- Official advisory designation: AA24-060A.
- Published on 2024-02-29 by CISA & FBI.
- Directly correlated with 2 primary case dossier(s) in this library.
- Provides joint government TTPs, MITRE ATT&CK indicators, and prioritized enterprise mitigations.
Referenced Common Vulnerabilities and Exposures (CVEs)
Related Primary Court Cases & Incident Forensics
ALPHV / BlackCat Ransomware Attack on Change Healthcare
Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
Prudential Financial ALPHV BlackCat Cloud Tenant Compromise
Material cybersecurity breach of Fortune 100 life insurer Prudential Financial, wherein ALPHV/BlackCat threat actors breached corporate administrative workstations and accessed cloud tenant data, filed under the four-day SEC Form 8-K Item 1.05 reporting mandate.
ATT&CK Techniques Cited in Advisory Matters
"The threat actor gained entry to a Change Healthcare Citrix portal using compromised credentials for an account that lacked multifactor authentication."
"ALPHV BlackCat ransomware was executed across corporate data centers, encrypting critical clearinghouse databases and disabling pharmacy claim gateways."
"Attackers exfiltrated 6 terabytes of protected health information and sensitive patient records before demanding a 350 Bitcoin ransom."
"Stolen medical claims and personally identifiable information were uploaded to adversary-controlled cloud servers prior to payload delivery."
"Initial entry occurred via an external remote Citrix access gateway lacking multifactor authentication controls."
"ALPHV BlackCat actors queried active directory LDAP services to identify enterprise domain administrator accounts."