Blackcat Ransomware Group

The BlackCat ransomware group, also known as Black Cat, has been active since November 2021. As a Ransomware-as-a-Service entity, it has targeted the computer networks of over 1,000 victims worldwide, with the FBI Miami leading the investigation into their activities. The group is notorious for its use of malware to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. It holds data hostage for ransom and has even launched a malvertising campaign to push Cobalt Strike, further expanding its malicious reach. In one notable incident, Change Healthcare, owned by UnitedHealth Group, paid a substantial ransom of $22 million to the BlackCat group following an attack. However, despite the payment, the threat actor proceeded to leak sensitive health information on millions of Americans on the Dark Web. This instance was particularly significant as UnitedHealth Group publicly acknowledged that it had only paid one ransom in the entire incident. The group claimed to have custody of 4 terabytes of data stolen by an affiliate of another ransomware group - BlackCat - in this hack. In a significant blow to the BlackCat ransomware group, the FBI managed to seize the group's servers, which hosted decryption keys. This seizure was part of an international disruption effort against the infamous group. Following the seizure, the FBI created a decryption tool that enabled 500 ransomware victims worldwide to restore their systems. Interestingly, the group seemed to shut down in March after receiving the $22 million extortion payment from Optum's Change Healthcare medical billing middleman unit. However, despite the shutdown, the aftermath of their attacks continues to affect victims.