Behind the Scenes of the Change Healthcare Ransomware Attack Cyber Gang Dispute

Behind the Scenes of the Change Healthcare Ransomware Attack Cyber Gang Dispute

Editor's Note - The situation with the Change Healthcare cyberattack is changing frequently. The information in this blog is current as of April 16. We will update the blog as needed.

The recent claim by the ransomware groupRansomHubthat it had successfully conducted an attack against Change Healthcare is most likely nothing more than the public exposure of a behind-the-scenes battle taking place between two threat groups.

Tomy knowledge, the new attack against Change Healthcare isn't a ransomware attack; instead, the claim is part of a soap-opera-level drama between the ransomware-as-a-service gang BlackCat/ALPHV and its affiliate (potentially operating under the alias notchy), who has turned to the new ransomware gang"RansomHub for help.

RansomHub's recent claim, if true, would have marked the secondtime in as many months that Change Healthcare had been struck by ransomware. However, I found quite a few clues in media reports and the gang's leak site that led me to another conclusion.

I've created a timeline based on analysis of the new "attack" to help visualize what is happening.

1. In March 2024, BlackCat/ALPHV affiliate gained initial access to the Change Healthcare enterprise environment.

2. A BlackCat/ALPHV affiliate allegedly named notchy utilized the ransomware tool offered by BlackCat/ALPHV to ransom the Change Healthcare environment.

3. After the ransomware attack was conducted, negotiations took place between BlackCat/ALPHV and Change Healthcare.

4. A ransom payment of $22 million was settled between the two parties. Change Healthcare then paid the operators of BlackCat/ALPHV $22 million to decrypt their files.

5. Once BlackCat/ALPHV received the payment, the BlackCat/ALPHV leak website was taken down. BlackCat/ALPHV originally claimed this as a simple outage, but there is more to the story.

a. Normally, during this step, after a ransomware operator has received a ransom payment from a victim, the ransomware operator would split the ransom payment with the affiliate that gained initial access and conducted the attack on the victim's environment. BlackCat/ALPHV is a Ransomware-as-a-Service group (RaaS) and generally offers a 60% to 90% commission for affiliates, meaning this attack culd have made the affiliate anywhere from $13.2 million to $19.8 million.

b. An operator of the BlackCat/ALPHV ransomware gang mentioned that the group had decided to terminate ALPHV aka BlackCat RaaS operations allegedly due to the "continuous" law enforcement intervention with the intention to sell the source code of the program.

6. The affiliate reported on a cybercriminal forum on March 3, 2024, that BlackCat/ALPHV did not forward their cut of the $22 million ransom payment. The affiliate also mentioned that its access to the BlackCat/ALPHV RaaS platform was suspended.

7. The BlackCat/ALPHV leak website was then brought back online on March 5, 2024, this time showing the below screenshot, which is still displayed as of April 11.

a. But who posted this notice? Was it the result of a new law enforcement operation against BlackCat/ALPHV? After all, the US Justice Department in December 2023 reported the gang had been disrupted by just such an operation. An additional tidbit pointing toward this being the work of the threat actors conducting an exit scam and not LEO activity, is the National Crime Agency (NCA) said it had nothing to do with the supposed takedown described by the screenshot. Despite the image having an NCA logo.

8. At this point, security analysts noticed the takedown notice was similar to one that appeared during the December operation and concluded that this was an attempted exit scam by BlackCat/ALPHV. This similarity led me to conclude that BlackCat/ALPHV does not intend to pay the affiliate its cut of the Change Healthcare ransom payment. Instead, BlackCat/ALPHV has opted to cease operations and keep the entire sum.

9. Roughly one month after these events transpired, a new post was made to the RansomHub leak website (see Figure 1 below) containing information related to Change Healthcare. RansomHub set the warning to expire on April 20, 2024, and stated that if a deal was not agreed upon between the two parties (RansomHub and Change Healthcare), the stolen data would be put up for auction and sold to the highest bidder.However, on April 15, RansomHub posted patient record files itclaimed to be from Change Healthcare to its leak site, according to a media report.

a. It does not appear that RansomHub has encrypted any of Change Healthcare's environment, as it has not mentioned so in the post on the leak site. In past ransom posts made on the group's website, it typically makes mention of data being encrypted or says:

i. "Instead of paying us, you are choosing to rebuild which is going to take longer than decrypting your network would." - From a post made against a victim in the financial sector.

ii. "You have a week to make a deal with us. After that time, we will remove the decryption key for your network and publish all of your sensitive data." - From a post made against a victim in the accounting sector.

iii. "Their network was compromised, and customer data was encrypted." - From a post made against a victim in the technology sector.

b. RansomHub did not mention any encryption or decryption within the Change Healthcare post.

c. RansomHub is a new group, that began operating somewhere around February 2, 2024. In fact, RansomHub is believed to be a rebrand/successor of the ransomware group Knight aka Cyclops, which emerged in August 2023.

Figure 1

RansomHub updated the information on or about April 16 declaring the data is now for sale. (Figure 2)

Figure 2

Final Analysis of Events

Let's sum up and draw some conclusions from the timeline.

Information provided on the RansomHub leak site leads me to believe that Change Healthcare wasn't attacked and ransomed for a second time. RansomHub is just leveraging the data stolen from Change Healthcare to extract another payment from the victim organization.

There is a little wiggle room when it comes to exactly how this will play out. I believe there are two likely scenarios based on the new information provided on RansomHub's leak site:

• The affiliate that originally worked with BlackCat/ALPHV is upset that it did not receive its share of the ransom payment made to the RaaS group. The affiliate has some or all of the data stolen during the attack and turned to the RansomHub RaaS gang to aid in extracting a payment from the victim organization. Essentially leveraging the data stolen during the first attack to receive some payment for its work.A classic triple-extortion ransomware attack.

RansomHub was likely never inside Change's network, only the original affiliate notchy, so, it's unable to encrypt that environment triggering a second full-blown ransomware attack. It is relying on Change Healthcare's desire to stop the stolen data from being released.

• My expectation is the latest ransom demanded by the affiliate is much lower than the $22 million Change initially paid, as RansomHub has less leverage because it has not encrypted Change Healthcare's environment but has only exfiltrated data and is threatening to sell it.

• In my opinion, the second, less likely scenario, is that RansomHub is leveraging Change Healthcare's already displayed willingness to pay criminal organizations to extract an additional payment. It may have a small portion or none of the data stolen by the criminal actors during the original BlackCat/ALPHV attack.

If nothing else, this situation teaches us that organizations should implement anti-ransomware tactics and follow government guidance in response to ransomware attacks. Procedures and policies must be in place detailing the organization's incident response plan to a ransomware or any kind of attack.

The first-time responders see this type of attack should be during a tabletop or Red Team exercise in a training environment not during an actual attack This will ensure all parties know what actions they need to take, including all incident response team members, DFIR analysts, public relations personnel, and C-level executives. Proper training and preparedness can relieve some of the ambiguity of a highly stressful situation, allowing proper action to be taken in an adequate time frame.

The other decision that should be made ahead of any incident is whether to pay the ransom. Paying the ransom may solve the immediate problem of restoring systems, but it may also mark an organization.

This is one of the reasons the FBI has advised that victim organizations do not pay ransom demands in response to an attack.

Also, making a payment does not guarantee that files will be decrypted or that the stolen data will be returned and not leaked.

At the end of the day, these are criminal organizations. While they claim to abide by some morals or guidelines, they have proven time and time again that they will do whatever they can to extract as much financial gain as they can, whether that be directly from victim organizations or other criminals.