Security News > 2024 > March > Possible China link to Change Healthcare ransomware attack
A criminal claiming to be an ALPHV/BlackCat affiliate - the gang responsible for the widely disruptive Change Healthcare ransomware infection last month - may have ties to Chinese government-backed cybercrime syndicates.
"Some of our HUMINT sources with direct contact to Notchy says it's high probability that Notchy is associated with China Nation-State groups," Menlo's threat intel team said in a report Wednesday.
The report includes a screenshot from Ramp user Notchy claiming to be the affiliate responsible for the Change ransomware attack.
"Without more details on the Change Healthcare attack, we are unable to determine if this malware was used against them or not."
The ransomware infection, in addition to having a material impact on UnitedHealth, has had devastating effects on the US healthcare system and the patients it serves.
The association, whose members include about 5,000 US hospitals and other healthcare organizations, has urged Congress to pass a financial assistance program and provide "Immediate access to funding" for all providers impacted by what it describes as the "Worst cyberattack on our healthcare system in history." .
News URL
Related news
- Mega US healthcare payments network restores system 9 months after ransomware attack (source)
- City of Columbus: Data of 500,000 stolen in July ransomware attack (source)
- Columbus, Ohio, confirms 500K people affected by Rhysida ransomware attack (source)
- China's Volt Typhoon reportedly breached Singtel in 'test-run' for US telecom attacks (source)
- Critical Veeam RCE bug now used in Frag ransomware attacks (source)
- Halliburton reports $35 million loss after ransomware attack (source)
- New Ymir ransomware partners with RustyStealer in attacks (source)
- New Ymir Ransomware Exploits Memory for Stealthy Attacks; Targets Corporate Networks (source)
- T-Mobile US 'monitoring' China's 'industry-wide attack' amid fresh security breach fears (source)
- New 'Helldown' Ransomware Variant Expands Attacks to VMware and Linux Systems (source)