Blackcat Ransomware Group

The BlackCat ransomware group, also known as Black Cat, is a notorious Ransomware-as-a-Service organization that has been active since November 2021. The group has targeted the computer networks of over 1,000 victims worldwide, launching malicious campaigns to exploit and damage systems. In one notable incident, the group infiltrated MGM's infrastructure, encrypting more than 100 ESXi hypervisors after the company took down its internal infrastructure. The group also launched a malvertising campaign to push Cobalt Strike, further demonstrating their capability and intent to cause widespread harm. In a significant event, Change Healthcare, owned by UnitedHealth Group, paid a $22 million ransom to the BlackCat ransomware group following an attack. Despite the payment, the threat actor leaked sensitive health information on millions of Americans on the Dark Web. This action demonstrated the group's disregard for agreements made during ransom negotiations. Furthermore, it was revealed that the group claimed to have custody of 4 terabytes of data stolen by an affiliate of another ransomware group in a separate hack. However, law enforcement has been active in combatting the BlackCat group. The FBI, with Miami leading the investigation, seized the group’s servers, which hosted decryption keys. As part of an international disruption effort, the FBI created a decryption tool that enabled approximately 500 ransomware victims worldwide to restore their systems. Despite these efforts, the group appeared to shut down in March after receiving the $22 million extortion payment from Change Healthcare, leading to speculation about an exit scam.