Black Cat Attack on UnitedHealth Group

The Blackcat Cyber gang, also known as ALPHV and Noberus, is a ransomware family written in rust. The first appearance of the organization was in November 2021. Blackcat operates on ransomware as a service (RaaS) model. Developers offer the malware for use by affiliates and take a percentage of ransom payments. In April 2022, the FBI released a warning regarding various developers and individuals involved in money laundering activities, who were connected to two disbanded Ransomware-as-a-Service (RaaS) groups, Darkside and BlackMatter, with ties to Blackcat. The research shows that the ransomware was a rebranding of Darkside after their last attack on May 2021.

Blackcat has had many more attacks, including an attack on Reddit, a popular social media platform. Blackcat used “sophisticated and highly targeted” phishing attack to get information from data and employees. In February 2024, the U.S. Department of State is offering rewards of up to $10 million for anyone having any intel on the Blackcat Cyber gang.

In the most recent update on the UnitedHealth Care attack, they confirmed that the attack was caused by Blackcat. The attack was a ransomware attack asking for millions of dollars. 3 weeks after the breach, the U.S. Department of Health and Human Services launched into UnitedHealth. UnitedHealth care are currently working on understanding the impact it has on customers, patients, and members. Blackcat steals sensitive information and threatens to leak it unless a ransom it paid. They also compromised computer networks worldwide and stole hundreds of millions of dollars.