DOJ disrupts ALPHV/Blackcat ransomware group
The Department of Justice announced Dec. 19 the launch of a disruption campaign against a ransomware group that has targeted the computer networks of more than 1,000 victims, including networks that support critical U.S. infrastructure. The Blackcat ransomware group, also known as ALPHV or Noberus, has become the second-most prolific ransomware-as-a-service variant in the world during the past 18 months, based on the hundreds of millions of dollars in ransoms paid by victims. Multiple foreign law enforcement agencies are also conducting investigations into the ransomware group.
The FBI has developed a decryption tool allowing its field offices nationwide and foreign law enforcement partners to offer more than 500 affected victims the capability to restore their systems. So far, the agency has worked with dozens of victims in the U.S. and internationally to implement the tool, which has saved victims from approximately $68 million in ransom demands. Additional tactics have been recommended by the FBI and the Cybersecurity and Infrastructure Security Agency in an advisory.
“Helping victims of crime is the FBI’s highest priority and is reflected here in the provision of tools to assist those victimized in decrypting compromised networks and systems," said FBI Deputy Director Paul Abbate. "The FBI will continue to aggressively pursue these criminal actors wherever they attempt to hide and ensure they are brought to justice and held accountable under the law.”
John Riggi, AHA’s national advisor for cybersecurity and risk, said, “This group has attacked numerous hospitals, publicly exposed sensitive patient data and placed patient care and lives at risk. The AHA applauds the excellent work of the FBI, DOJ and international partners who joined forces to disrupt the notorious ALPHV/Blackcat ransomware gang. This aggressive enforcement action combined with a focus on assisting victims is the right strategy. This also serves as an example of how essential it is for victims of cyberattacks and the health care sector to exchange cyberthreat intelligence with the government to assist their ability to go after the ‘bad guys’ and diminish their capability to conduct future attacks. One team, one fight.”
For more information on this matter or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk threat information and resources visit www.aha.org/cybersecurity.