Tag: Cyberattack

Categories
Business News SmartBuzz Tech Top News World

The Cyber Siege on US Change Healthcare: A Dive Into The ALPHV Hack

In a chilling cyber saga that has sent shockwaves through the US healthcare system, Change Healthcare found itself at the mercy of the notorious ransomware group ALPHV, also known as BlackCat. The attack, unveiled on February 21, 2024, plunged the company into chaos, disrupting the intricate web of transactions that underpin the nation’s healthcare infrastructure.

The Intrusion: Dissecting the Breach

ALPHV’s clandestine entry into Change Healthcare’s network remains shrouded in mystery, with hints pointing to vulnerabilities in Microsoft’s remote desktop protocol and ConnectWise Screen Connect application. Once inside, the attackers unleashed ransomware, paralyzing critical systems and services. The repercussions were swift and severe, with healthcare providers grappling to maintain operations amidst the digital turmoil.

The Ransom Demand: A Sinister Ultimatum

ALPHV’s demand for ransom to restore services echoed ominously across the healthcare landscape. While Change Healthcare’s response to the ransom remains undisclosed, security researchers suggest a payment might have been made. The shadow of uncertainty looms large, underscoring the high-stakes game of cyber extortion that unfolded in the heart of the healthcare realm.

Alphv_Ransomware
A confirmation of the payment of 350BTC to ALPHV (Blackcat). Image: Courtesy

The Alleged Scam and Deception

Amidst the chaos, whispers of a scam involving an affiliate payment surfaced, painting a picture of treachery within the cyber siege. Reports suggest that the affiliate, slated to receive 80% of a payment, fell victim to deception, raising questions about the integrity of the ransom negotiation process.

AlphV_Change_Healthcare
The post by ALPHV affiliate who allegedly has been in turn scammed by the same Ransomware Group. Image: Courtesy

As the dust settles on this cyber battlefield, Change Healthcare stands as a stark reminder of the vulnerabilities that pervade the healthcare sector. The ALPHV hack serves as a chilling testament to the fragility of digital fortresses and the far-reaching implications of cyber warfare in an increasingly interconnected world.

 

Categories
Business News Tech Top News World

Nationwide Telecoms Downtime Sparks Suspicions of Major Chinese Cyberattack Test on US Infrastructure.

On Thursday, February 22, 2024, a massive cellular phone service outage hit thousands of users across the United States, affecting all major telecoms, including AT&T, Verizon, T-Mobile, USCellular, Cricket Wireless, and Boost Mobile.

The outage disrupted calls, text messages, and emergency services in major cities, including San Francisco, and lasted for at least five hours.

 

The supposed nationwide outage has raised concerns about the reliability of telecommunications infrastructure and its resilience in the face of unexpected disruptions. While there is no official confirmation of a cyberattack, the possibility of a major hack cannot be ruled out.

Screenshot of the suspicious nationwide telecoms outage. Image/Courtesy

The Federal Communications Commission (FCC) has announced that it will investigate the incident, and the US Cybersecurity and Infrastructure Security Agency (CISA) is working closely with AT&T to understand the cause of the outage and offer any assistance needed.

 

The outage affected more than 73,000 incidents around 8:15 a.m. ET, and reports suggest that the disruption was caused by a cyberattack on the telecoms’ infrastructure. The suspicion of a cyberattack has sparked concerns about the vulnerability of critical infrastructure to cyber threats and the need for stronger cybersecurity measures to protect against such attacks.

 

In conclusion, the nationwide telecoms downtime has raised serious concerns about the reliability and security of telecommunications infrastructure in the United States. The possibility of a major cyberattack underscores the need for stronger cybersecurity measures to protect against such threats and ensure the resilience of critical infrastructure.

 

Categories
Tech Top News World

Wave of Cyberattacks Targeting US Telecoms: Third-Party Vendors Allegedly to Blame.

Since the start of the year, cyberattacks targeting US telecommunications companies have been relentless, with over 74 million private records tied to customers of AT&T, T-Mobile, U.S. Cellular, and Verizon spilling onto the dark web.

 

In report posted by Cyble Research and Intelligence Labs, six previously reported data breaches impacting telecoms since the start of the year were carried out by exploiting security weaknesses on third-party vendor networks.

The vast majority of these breaches were caused by third-party vendors, software, and MSPs (managed service providers).

The breaches have led to targeted SIM swapping attacks on Google Fi, which uses T-Mobile as its primary service provider.

 

Another concern is that telecom networks “are widely used for multi-factor authentication and for sharing of business data (making them attractive targets,” said Bud Broomhead, CEO at Viakoo. The timing of when a breach is reported matters: the faster, the better to shrink the vulnerability window.

 

In response to the breaches in the telecommunications sector, the FCC issued a statement pushing for a change in current breach notification guidelines, proposing the removal of the compulsory seven-day waiting period before customers are notified of breaches, as well as expanding the scope of federal agencies that receive breach notifications to include the FCC, FBI, and the U.S. Secret Service. The threat landscape has shifted to more diverse types of threats, with adversaries interested in telco customer data to perpetrate additional crimes such as SIM jacking.

 

Third-party security risks are often hard to identify by downstream firms, and these risks have resulted in some of the past years’ biggest cyberattacks.

Telecoms companies must take third-party risks seriously and implement organization-wide zero-trust policies to minimize supply chain compromise.

The forthcoming National Cyber Strategy is expected to push for stronger public incident reporting, including in incident reporting.