Hacking News

Change Healthcare reportedly paid Black Cat (ALPHV) a $22 million ransom in early March 2024 — and the ransomware group promptly exit-scammed its own affiliates, seized the full payment, posted a fake FBI seizure notice, and put its source code up for sale, leaving 4 terabytes of stolen patient and insurance data still in criminal hands.

Stories Covered

Black Cat Exit-Scams Its Own Affiliates After $22M Change Healthcare Ransom Payment

Change Healthcare, a technology subsidiary of UnitedHealth Group that processes prescription drug transactions for hospitals and pharmacies nationwide, was hit by Black Cat (ALPHV) ransomware on February 23, 2024. The attack took down the systems that pharmacies use to verify insurance eligibility and process claims, meaning patients at the pharmacy counter either could not fill prescriptions or were forced to pay full out-of-pocket costs for medications their insurance would normally cover. The disruption cascaded through the healthcare supply chain for weeks. On or around March 1st, a Bitcoin address security researchers had already mapped to Black Cat received a single transaction of approximately $22 million — consistent with a ransom payment. On March 3rd, a Black Cat affiliate posted on the Russian-language ransomware forum RAMP claiming to be the individual who had provided Black Cat with initial access to Change Healthcare’s network. The affiliate’s complaint: Black Cat had received the $22 million, frozen the affiliate’s account, and refused to pay out the commission that was owed.

Black Cat operates as a ransomware-as-a-service collective. Affiliates — independent operators who find and breach targets — earn commissions ranging from 60 to 90 percent of any ransom paid. The core Black Cat administrators provide the ransomware infrastructure, encryption tooling, negotiation support, and leak site; affiliates bring the intrusions. In this case, the affiliate claimed they were owed a multi-million-dollar cut of the $22M payment and received nothing. The affiliate warned on RAMP that they still possessed four terabytes of data stolen from Change Healthcare’s network, including records tied to Medicare, CVS Caremark, HealthNet, and MetLife. They explicitly threatened to leak the data independently if Black Cat didn’t pay and warned other ransomware operators to stop working with ALPHV. The stolen data pool covering major insurance networks and pharmacy partners represents substantial personal health information, insurance records, and financial data at scale.

Following the affiliate complaint, Black Cat’s leak site went dark and the group posted what appeared to be an FBI seizure banner — the same type of notice that appeared when law enforcement seized Black Cat’s infrastructure in December 2023. Security researchers, including Fabian Wosar of Emsisoft, quickly identified the notice as a copy-paste job from the earlier real seizure, not an authentic law enforcement action. The FBI did not confirm any new action against Black Cat. Simultaneously, Black Cat announced it was selling its ransomware source code for $5 million. Wosar stated publicly that Black Cat was exit-scamming its affiliates — a deliberate final move to extract maximum cash before shutting down the brand. By withholding commissions from multiple affiliates at once and disappearing with the accumulated ransoms, the Black Cat administrators essentially robbed the people they had relied on to run their criminal enterprise. The December 2023 FBI operation had already compromised Black Cat’s infrastructure; the group rebuilt and continued operating, but its position as the dominant ransomware actor after LockBit 3.0’s takedown apparently made it a priority target, and the administrators appear to have decided to cash out before law enforcement closed in again.

Several dynamics worth noting. Paying the ransom did not end Change Healthcare’s exposure — it funded the criminal enterprise while leaving the stolen data in the hands of a disgruntled affiliate who was never paid and had every incentive to leak or re-extort. This outcome recurs: ransomware payment does not guarantee data deletion, because the operators and affiliates are not bound by the same agreement and have competing financial interests. The affiliate structure that makes ransomware-as-a-service scalable also makes it unstable — when the administrators steal the ransom from the people who executed the attack, those affiliates still have the data and the access logs and no reason for loyalty. The takeaway for organizations is that payment creates a second exposure problem rather than ending the first one. Separately, analysts noted a possible additional explanation: that Russian government pressure may have directed Black Cat’s administrators to pivot capabilities toward Ukraine-related operations and wind down the commercial ransomware operation, though the source code sale and affiliate exit scam pattern is more consistent with a financial grab than a state-directed shutdown.

Listen to the Episode

Black Cat (ALPHV) ransomware struck Change Healthcare — the largest prescription payment processor in the US — in late February 2024, disrupting prescription drug access at more than 70,000 pharmacies nationwide and claiming to have stolen 6 terabytes of data including records tied to TRICARE, Medicare, CVS Caremark, and other major insurance and healthcare networks.

Stories Covered

Black Cat Ransomware Hits Change Healthcare, Knocking Out Prescription Processing Nationwide

Change Healthcare, a technology subsidiary of UnitedHealth Group, is the backend infrastructure that pharmacies use to transmit insurance claims and verify patient coverage before dispensing prescriptions. When a patient goes to a pharmacy, the system communicates with their insurer to confirm eligibility, calculate copays and coinsurance, and authorize the transaction — a process most people never see because it happens in seconds. On approximately February 20, 2024, Black Cat (ALPHV) ransomware operators gained access to Change Healthcare’s systems and took them offline. The disruption cascaded immediately: CVS, Walgreens, and pharmacy chains across the country reported they could not transmit insurance claims, leaving patients either unable to fill prescriptions or forced to pay full out-of-pocket costs that can run into hundreds or thousands of dollars for medications their insurance would normally cover. The American Pharmacists Association reported significant backlogs of prescriptions at pharmacies nationwide. Optum, the UnitedHealth subsidiary that owns Change Healthcare, acknowledged the outage and said it was working to restore systems. Mandiant — Google’s cybersecurity incident response division — was engaged to handle the investigation.

Black Cat publicly claimed responsibility on its dark web leak site, directly contradicting UnitedHealth Group’s early SEC filing that attributed the breach to a suspected nation-state actor. Security analysts pushed back on that characterization immediately — ALPHV is a financially motivated ransomware-as-a-service operation with no known nation-state affiliation. The group claimed to have exfiltrated more than six terabytes of data from Change Healthcare’s production network, describing it as highly selective data covering all Change Health clients with sensitive data being processed by the company. The claimed stolen dataset included source code for Change Healthcare solutions, records tied to the US military’s TRICARE healthcare program, Medicare, CVS Caremark, health insurance providers, and personal identifying information for patients across the network. Change Healthcare processes payments for over 70,000 pharmacies and is used by more than 1.6 million physicians, 8,000 hospitals, and other care facilities. The scale of the potential data exposure — across military personnel, Medicare beneficiaries, and commercial insurance customers — represents a significant long-tail risk for phishing and identity fraud well beyond the immediate service disruption.

The attack came after Black Cat’s December 2023 takedown by FBI-led international law enforcement, which seized the group’s infrastructure and hundreds of decryption keys. The group rebuilt, increased affiliate commissions to as high as 90 percent, and explicitly removed prior restrictions against targeting hospitals and healthcare providers — language that had been in place partly to avoid attracting law enforcement attention to critical infrastructure attacks. The FBI, CISA, and the Department of Health and Human Services issued a joint advisory warning that Black Cat affiliates had been primarily targeting US healthcare organizations since mid-December 2023. The advisory noted that healthcare is a particularly attractive target: large volumes of sensitive data, significant revenue, and widely documented use of outdated infrastructure — some hospital systems still run equipment on Windows XP-era operating systems. FBI tracking placed Black Cat behind over 60 breaches in its first four months of operation and estimated the gang collected at least $300 million in ransoms from more than 1,000 victims through September 2023. The US government had separately announced rewards of up to $10 million for information leading to the identification or location of Black Cat leadership. The Change Healthcare attack signaled that the December takedown had not meaningfully degraded Black Cat’s operational capacity — it had accelerated their targeting of exactly the sector most likely to cause public harm.

Listen to the Episode

Operation Kronos — a joint operation by the UK National Crime Agency, FBI, Europol, and partners across more than ten countries — dismantled LockBit ransomware’s infrastructure in February 2024, seizing 34 servers and more than 200 cryptocurrency accounts and arresting members in Ukraine and Poland, targeting a group that controlled roughly 25% of the global ransomware market.

Stories Covered

Operation Kronos Seizes LockBit’s Infrastructure and Turns Its Own Website Against It

LockBit was not simply one of the larger ransomware groups — it held an estimated 25% of the ransomware market, a share so dominant that no other group came close in the double digits. The US alone documented more than 1,700 victim organizations spanning financial services, food production, schools, transportation, and government. Analysts described it as the Walmart of ransomware: politically neutral, operationally disciplined, and run like a business optimizing for maximum return. LockBit pioneered the ransomware-as-a-service model at scale — affiliates would gain initial access to target networks, deploy LockBit’s tooling to encrypt data and exfiltrate it, and split the ransom with LockBit operators. The gang had accumulated enough operational history that it openly operated a dark web leak site displaying countdown timers next to victim names: when the clock hit zero, stolen data would be published unless the ransom was paid. The site was updated nearly daily.

On February 19, 2024, authorities from the UK NCA, FBI, US Department of Justice, Europol, and agencies in France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland, and Germany announced they had disrupted LockBit’s core infrastructure under Operation Kronos. Law enforcement seized servers running in the Netherlands, Germany, Finland, France, Switzerland, Australia, the US, and the UK — 34 servers total across the affiliate and operator network. More than 200 cryptocurrency accounts linked to the gang were frozen. The FBI also obtained decryption keys and made them available to LockBit victims to recover encrypted data without paying a ransom. Two Russian nationals were charged with deploying LockBit ransomware tools against companies worldwide. The most tactically pointed move: law enforcement took control of LockBit’s own dark web website and used it against the group — replacing the gang’s victim gallery with a message reading, “We have source code, details of the victims you have attacked, the amount of money extorted, the data stolen, chats, and much, much more.” The site then displayed countdown timers — LockBit’s own signature tactic — pointing to a scheduled disclosure of the gang’s internal data rather than victim data.

LockBit’s operators posted on an encrypted messaging app claiming their PHP-based servers had been targeted but that backup servers without PHP remained unaffected. Security researchers from VX Underground shared screenshots confirming the affiliate control panel had been replaced by the law enforcement message. The FBI did not immediately confirm or deny the backup server claim. LockBit had been discovered in 2020 when its malware first appeared on Russian-language cybercrime forums; despite this, the group publicly claimed to be apolitical and located in the Netherlands, motivated purely by financial return. By September 2023, the group had collected at least $300 million in ransoms from more than 1,000 victims. Operation Kronos represented a rare multi-continent coordinated action of sufficient scale to match what LockBit had built — a point that itself illustrates how significant the threat had become before law enforcement moved.

Father-Son Duo Arrested in Ukraine, Warsaw Member Identified in Poland

On February 21, 2024, Ukrainian police announced the arrest of a father and son in Ternopil, western Ukraine, both of whom were identified as LockBit affiliates. The pair had carried out attacks targeting government institutions and corporations in France. Mobile phones and computer equipment used in the attacks were seized. Their arrest came as part of Operation Kronos and was carried out with assistance from a French cyber police unit — France had been a driving force behind the operation after opening its own LockBit investigation in 2020. By the time of the takedown, France had recorded more than 200 LockBit victims within its borders, including hospitals, municipal governments, and businesses. In January 2022, LockBit had publicly claimed on its leak site to have breached French entities — a provocation that accelerated French law enforcement’s push for coordinated international action. In Poland, a 38-year-old Warsaw man was identified and arrested as a LockBit gang member, also with assistance from French cyber police units.

The arrests illustrated how Operation Kronos extended beyond seizing infrastructure to actively targeting the affiliate layer — the operators who did the actual intrusions and ransomware deployments on behalf of LockBit’s core. This matters because ransomware-as-a-service operations are distributed by design: taking down central infrastructure degrades capability, but affiliates with their own access and tooling can rebuild or migrate to a competing platform. The seizure of 200+ cryptocurrency accounts across the network complicated the financial picture for any surviving affiliates. The broader question left open was whether the core LockBit developers — the people who built and maintained the encryption tooling — were among those arrested or whether only affiliates and lower-level members had been taken. If the technical core survived, a rebuild was possible. If not, other ransomware groups — Black Cat being the next largest — would absorb displaced affiliates and market share, though likely with increased caution given the heat Operation Kronos demonstrated law enforcement could bring.

Listen to the Episode

Microsoft and OpenAI jointly disclosed that five nation-state APT groups from Russia, China, Iran, and North Korea had been actively using large language models for offensive cyber operations — from scripting and phishing content to satellite protocol research and CVE analysis — before OpenAI shut down all their accounts.

Stories Covered

Russia, China, Iran, and North Korea APTs Caught Using OpenAI for Cyber Operations

A joint blog post from Microsoft and OpenAI documented five major threat actor clusters — all aligned with nation-state sponsors — using OpenAI’s large language models to enhance offensive cyber operations. After identifying the accounts, OpenAI terminated all of them. The disclosure is notable not because the techniques involved were novel, but because it confirms that nation-state actors are integrating commercial AI into their existing workflows the same way legitimate organizations are: as a productivity accelerator. Microsoft explicitly noted that none of the observed LLM abuse had produced particularly novel or unique attack techniques — these actors were not using AI to discover new attack categories, but to do existing work faster and at better scale.

Forest Blizzard, the GRU-affiliated Russian military unit also known as Fancy Bear and linked to hacks of the Democratic National Committee and Ukrainian military targets, was using LLMs for basic scripting tasks, file manipulation, data selection, and multi-processing, as well as intelligence gathering on satellite communication protocols and radar imaging technologies — capabilities directly relevant to the ongoing war in Ukraine. Two Chinese APT groups were also identified. Charcoal Typhoon (also tracked as APT40 and Aquatic Panda) used LLMs for both pre-compromise and post-compromise tasks: gathering information about specific technologies and vulnerabilities, generating and refining scripts, producing social engineering content in multiple translated languages, and querying for guidance on achieving deeper system access after initial compromise. Salmon Typhoon used OpenAI primarily as an intelligence tool — sourcing publicly available information on high-profile individuals, intelligence agencies, and geopolitical matters — while also attempting, largely without success, to get help writing malicious code and researching stealth tactics. OpenAI’s content policies have progressively restricted responses to requests for explicit malware assistance, so Salmon Typhoon’s attempts to use it that way hit those guardrails repeatedly.

Iran’s Crimson Sandstorm (also known as Imperial Kitten and Tortoiseshell) was using LLMs to develop phishing email content — drafting messages impersonating an international development agency and a feminist advocacy group — as well as generating code for web scraping and task automation, and using ChatGPT as a translation tool to craft convincing lure content in multiple languages. North Korea’s Emerald Sleet (also tracked as Kimsuky) was using LLMs for basic scripting, phishing content generation, and researching publicly available information about CVEs, nuclear weapons experts, think tanks, and government organizations working on defense and nonproliferation. Like the others, Emerald Sleet was using AI as a faster, more interactive search engine for targeting research rather than as a code generation engine for novel attack tooling.

The pattern across all five groups is consistent: LLMs being used as productivity tools that accelerate existing tradecraft rather than enabling entirely new attack categories. An experienced threat actor who would spend three days researching satellite communication protocols can now do it in hours. A group that would take weeks to translate phishing lures across five languages can do it in an afternoon. A developer translating malware from C++ to Golang — a language with historically lower antivirus detection rates because fewer samples exist — can use an LLM to accelerate that translation without needing deep expertise in the target language. None of this is science fiction; all of it represents meaningful operational improvement for groups that already have the underlying capability. The more plausible near-term concern is malware that incorporates on-device AI processing — leveraging the tensor processing units and dedicated AI cores now shipping in consumer hardware from Apple, Google, and others — to enable adaptive behavior that evades signature detection. That capability does not exist in deployed malware today, but the hardware prerequisites are proliferating rapidly.

Listen to the Episode

Two stories this episode: a cyberattack on Fulton County, Georgia knocked out power, courts, tax processing, and phone services for the entire county government, while a critical Jenkins vulnerability (CVE-2024-23897) left 45,000 internet-exposed instances open to arbitrary file read and potential remote code execution after proof-of-concept exploit code went public.

Stories Covered

Cyberattack on Fulton County, Georgia Takes Down Courts, Tax Systems, and Phone Service

Fulton County, Georgia — home to Atlanta and one of the most populous counties in the southeastern United States — suffered a cyberattack in late January 2024 that knocked out county government infrastructure across multiple critical functions. Court filings, tax processing, the court system website, and county phone and internet service all went offline. Power outages compounded the disruption. County commissioner Rob Pitts stated that preliminary investigation did not indicate any transfer of sensitive citizen or employee data, but acknowledged the breach had caused significant operational disruption with no firm timeline for restoration. The incident was still developing at air time and no threat actor had been identified. The impact illustrated the cascading effect of a single breach on a government entity that provides interconnected services: when court systems, communications infrastructure, and tax processing all run through shared network infrastructure, a single point of compromise can halt the entire operation simultaneously.

Local and county governments are among the most chronically under-resourced targets in the threat landscape. The attack surface is large — court systems, utilities, emergency services, tax administration, and permit processing all require network connectivity and increasingly run on internet-facing infrastructure — while the cybersecurity budget and staffing at most county governments is a fraction of what comparably scaled private organizations maintain. The result is that a county government is simultaneously a high-value target (access to citizen records, legal proceedings, financial data) and a soft target (older systems, deferred patching, limited incident response capability). When a nation-state or sophisticated ransomware operation targets county infrastructure, it is effectively pitting the resources of an entire government or criminal enterprise against an entity whose IT department may consist of a handful of people. The Fulton County attack follows a broader pattern of critical infrastructure intrusions: water treatment plants, power infrastructure, pipeline operators, and government systems have all seen targeted intrusions in recent years. The consistent thread is that internet connectivity has been extended to infrastructure that was not designed with internet-scale threat models in mind, without proportionate investment in the defenses that connectivity requires.

Jenkins CVE-2024-23897: 45,000 Unpatched Servers Exposed to File Read and Potential RCE

Jenkins — the widely used open-source CI/CD automation platform — disclosed CVE-2024-23897 on January 24, 2024, a critical arbitrary file read vulnerability in the Jenkins built-in command line interface (CLI). The flaw allows an unauthenticated or low-privileged attacker to read arbitrary files from the Jenkins server filesystem, including credential files, secrets, and signing keys that the Jenkins process has access to. Depending on configuration, the vulnerability can be chained into remote code execution: if an attacker can also upload a file to the server (through any available mechanism) and then trigger execution via the read path, they can achieve RCE. The Jenkins security team released a patched version on the same day as disclosure and advised that organizations unable to patch immediately should disable the Jenkins CLI as a workaround.

By January 29th — five days after the patch release — the nonprofit threat monitoring organization Shadow Server reported approximately 45,000 internet-exposed Jenkins instances still running the unpatched version, with nearly 12,000 of those located in the United States. China had a comparable number of exposed systems. Proof-of-concept exploit code had already been published publicly, meaning any attacker with basic capability could target the 45,000 unpatched systems without needing to independently develop an exploit. Jenkins is used heavily in software development pipelines across enterprise, government, and startup environments — a compromised Jenkins server typically has access to source code repositories, build artifacts, deployment credentials, cloud provider keys, and production signing certificates. An arbitrary file read on a Jenkins instance is therefore not just a server compromise; it is a potential stepping stone into the entire software supply chain that Jenkins serves. Patch immediately, or disable the CLI as an interim measure until patching is possible.

Listen to the Episode

Two food industry giants hit in the same week: Jason’s Deli disclosed a credential stuffing attack that compromised 344,000 loyalty accounts using stolen credentials harvested from unrelated data breaches, while LockBit 3.0 claimed it exfiltrated hundreds of gigabytes from Subway’s internal SBS franchise network — a notable target shift for a ransomware group that typically preys on mid-size companies.

Stories Covered

Jason’s Deli Credential Stuffing: 344,000 Loyalty Accounts Compromised

Jason’s Deli, the Texas-based soup and sandwich chain, notified customers in early 2024 that its Deli Dollars loyalty program had been hit with a credential stuffing attack exposing the personal data of more than 344,000 members. Credential stuffing is the automated reuse of username and password combinations leaked from previous, unrelated breaches: attackers collect credential dumps from past incidents, then run automated tools against other websites in bulk, betting that users reuse the same login across multiple services. Jason’s Deli confirmed to the Maine Attorney General’s office that the credentials used in the attack were “most likely from other data breaches or sources not involving Jason’s Deli.” The compromised accounts exposed names, addresses, phone numbers, birth dates, preferred store location, order history, group order contacts, house account numbers, loyalty point balances, available rewards, and partial credit and payment card numbers — the full contents of a logged-in customer account.

The breach requires no sophistication in Jason’s Deli’s own infrastructure to execute — it is entirely a consequence of users reusing passwords across accounts without multi-factor authentication. The attacker does not need to break into Jason’s Deli. They need only obtain credential dumps from any previous breach anywhere, run them through a script, and collect the hits. The fix at the individual level is straightforward: a unique password per site (a password manager removes all friction from this) and app-based two-factor authentication wherever it is available. App-based MFA is meaningfully stronger than SMS-based MFA because SMS is vulnerable to SIM swapping attacks, where an attacker socially engineers a mobile carrier into reassigning the victim’s number to an attacker-controlled SIM. At the organizational level, the standard mitigations are rate limiting login attempts, detecting anomalous login volume, checking submitted credentials against known breach databases (services like HaveIBeenPwned offer APIs for exactly this), and prompting password resets for accounts whose credentials appear in public breach dumps.

LockBit 3.0 Claims Subway Breach: Ransomware Group Moves Up-Market

LockBit 3.0 posted a claim on its Tor leak site asserting it had exfiltrated hundreds of gigabytes of data from Subway’s internal SBS (Subway Franchisee Ordering System) network, including financial data across the entire franchise operation. Subway confirmed it was investigating the claims. The ransom deadline posted by LockBit was February 2nd, 2024. What made the claim notable beyond the brand recognition was the target profile: LockBit’s typical victim is a company in the $100 million revenue range, and Subway is a multi-billion dollar operation. Security researchers at Black Kite noted that Subway represents a meaningful expansion of LockBit’s target ceiling, consistent with a pattern seen in other recent incidents — including the Boeing breach via the Citrix Bleed vulnerability — where ransomware operators are increasingly targeting enterprise-scale organizations rather than staying in the mid-market.

The reason large enterprises are attractive despite their resources is the same reason they are difficult to defend: attack surface scales faster than security capacity. A billion-dollar franchise operation has thousands of franchisees, dozens of enterprise applications, a large corporate network, point-of-sale infrastructure in thousands of locations, and years of accumulated technical debt — all connected to the internet, all potentially patchable, and rarely all patched at once. An attacker has to find one gap. Black Kite’s analysis of Subway’s exposure flagged the same issues common to other large enterprises: large attack surfaces with slow patching cycles that create windows for vulnerability exploitation. LockBit held over 21% of global ransomware market share at the time of the Subway claim, had claimed more than 1,000 victims in the prior year, and had accounted for over 35% of total ransomware extortion attacks in early 2023. The playbook for organizations in this threat environment includes network segmentation (so a compromised POS system cannot reach financial databases), offline backups (so encryption does not mean permanent data loss), monitored credential exposure (so compromised employee accounts are detected before attackers pivot deeper), and current patching — not because any of these guarantees safety, but because each one raises the cost of successful attack above what opportunistic actors are willing to pay.

Listen to the Episode