Skip to navigation

Threat reportRansomwareTL-2026-5184

HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)

mediumRESOLVED

HHS Office for Civil Rights settled a HIPAA investigation of Lehigh Valley Health Network (LVHN) over a February 2023 ALPHV/BlackCat ransomware breach that exposed PHI of 248,359 individuals. LVHN agreed to an $800,000 payment and a three-year corrective action plan; the separate patient class action settled for $65 million. First disclosed .

Key facts for LVHN BlackCat breach

IdentifiersTL-2026-5184
Also known asLVHN ALPHV breach, Delta Medix breach
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsLehigh Valley Health Network Delta Medix IT systems / physician practice network supporting radiation oncology imaging (Lackawanna County, PA)
AttributionALPHV, BlackCat (high confidence)
Nation-state nexusRussia
MalwareALPHV/BlackCat, AnyDesk, BlackCat (Windows), BlackCat - S1068, Cobalt Strike, brute_ratel
ToolsBrute Ratel C4 - S1063, Cobalt Strike, Plink, ScreenConnect, SimpleHelp, Splashtop
MITRE ATT&CK techniquesT1078 Valid Accounts, T1136.002 Domain Account, T1219 Remote Access Tools, T1555 Credentials from Password Stores, T1557 Adversary-in-the-Middle, T1558 Steal or Forge Kerberos Tickets, T1567.002 Exfiltration to Cloud Storage, T1572 Protocol Tunneling, T1586 Compromise Accounts, T1598 Phishing for Information, T1657 Financial Theft, T1685 Disable or Modify Tools
MotivationFINANCIAL
Target sectorshealth
Target regionsNorth America
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for LVHN BlackCat breach

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5184 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ALPHV/BlackCat Evilginx2 AiTM Session Token Replay — Initial Access

TL-2026-5184 (ALPHV/BlackCat, LVHN). CISA AA23-353A documents ALPHV affiliates using Evilginx2 adversary-in-the-middle phishing to steal MFA-satisfied session tokens, then replaying them as valid accounts. This search finds successful MFA sign-ins where the same user appears from 2+ IPs with 2+ user agents inside 30 minutes, or where Entra ID Identity Protection raised attackerinTheMiddle / anomalousToken / tokenIssuerAnomaly risk. The TTP is generic ALPHV tradecraft, not confirmed for the LVHN intrusion.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1557, T1078, T1586
  • Data sources: azure_ad_signin_logs, azure:monitor:aad, entra_identity_protection
  • Severity: high
  • Confidence: medium

Splunk SPL

index=azure sourcetype="azure:monitor:aad" category=SignInLogs properties.status.errorCode=0 earliest=-24h
| rename "properties.userPrincipalName" as user, "properties.ipAddress" as src_ip, "properties.userAgent" as user_agent, "properties.appDisplayName" as app, "properties.authenticationRequirement" as auth_req, "properties.riskEventTypes_v2{}" as risk_types
| where auth_req="multiFactorAuthentication"
| bin _time span=30m
| stats dc(src_ip) as ip_count dc(user_agent) as ua_count values(src_ip) as src_ips values(user_agent) as user_agents values(app) as apps values(risk_types) as risk_types by _time user
| where (ip_count>=2 AND ua_count>=2) OR match(mvjoin(risk_types,","),"(?i)attackerinTheMiddle|anomalousToken|tokenIssuerAnomaly")
| eval detection="TL-2026-5184 ALPHV Evilginx2 AiTM token replay (T1557 T1078)"
| table _time user src_ips user_agents apps risk_types detection

Microsoft KQL

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0 and AuthenticationRequirement == "multiFactorAuthentication"
| extend RiskTypes = tostring(RiskEventTypes_V2)
| summarize IpCount = dcount(IPAddress), UaCount = dcount(UserAgent), IPs = make_set(IPAddress, 10), UserAgents = make_set(UserAgent, 10), Apps = make_set(AppDisplayName, 10), RiskTypes = make_set(RiskTypes, 10) by UserPrincipalName, bin(TimeGenerated, 30m)
| where (IpCount >= 2 and UaCount >= 2) or tostring(RiskTypes) matches regex @"(?i)attackerinTheMiddle|anomalousToken|tokenIssuerAnomaly"
| project TimeGenerated, UserPrincipalName, IpCount, UaCount, IPs, UserAgents, Apps, RiskTypes

Sigma

title: Entra ID Successful Sign-In With Adversary-in-the-Middle Risk Signal (ALPHV Evilginx2)
id: 5184a001-1f3c-4b7e-9a10-0a1b2c3d4e01
status: experimental
description: Detects successful Entra ID sign-ins flagged by Identity Protection with attackerinTheMiddle, anomalousToken or tokenIssuerAnomaly risk, the footprint of Evilginx2 style session token theft used by ALPHV affiliates per CISA AA23-353A (TL-2026-5184).
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.credential_access
    - attack.t1557
    - attack.initial_access
    - attack.t1078
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType: 0
        RiskEventTypes_V2|contains:
            - 'attackerinTheMiddle'
            - 'anomalousToken'
            - 'tokenIssuerAnomaly'
    condition: selection
falsepositives:
    - Legitimate users roaming between VPN and mobile networks can raise anomalousToken
    - Authorized red-team phishing simulations using Evilginx2
level: high

Known false positives:

  • Users switching between corporate VPN, mobile hotspot and a second device within 30 minutes
  • Authorized phishing simulations or red-team engagements using Evilginx2

Tuning notes: Exclude corporate VPN egress ranges and known mobile carrier ASNs, and restrict to privileged or remote-access-enabled accounts first. Raise the 30m window or the ip_count threshold if noisy; treat any Identity Protection attackerinTheMiddle hit as high priority regardless of the thresholds.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Help-Desk Credential/MFA Reset Followed by Sign-In From New IP — ALPHV Social Engineering · unlock with TL Creds
  • Kerberoasting — RC4 TGS Request Burst Across Multiple SPNs (ALPHV Credential Access) · unlock with TL Creds
  • Data Exfiltration to [indicator] / Dropbox by Non-Browser Process — ALPHV Double Extortion · unlock with TL Creds
  • ALPHV Affiliate Remote Access Tool Installation — ScreenConnect, SimpleHelp, AnyDesk · unlock with TL Creds
  • ALPHV Pre-Encryption Defense Impairment, Log Clearing and Ransom Note Creation · unlock with TL Creds
  • ALPHV C2 Tunneling and Beacon Tooling — Plink, Ngrok, Fake conhost.exe, Cobalt Strike Pipes · unlock with TL Creds
  • ALPHV Persistence — Rogue Domain Account 'aadmin' and Privileged Group Add · unlock with TL Creds
  • ALPHV C2 Infrastructure Contact — CISA AA23-353A IPs/Domains and Community Siblings · unlock with TL Creds

Indicators of compromise for LVHN BlackCat breach

As of 2026-11-03, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5184.

Sample indicators (3 of 25)

  • IP address: 5.199.168[.]24
  • Domain: resources[.]docusong[.]com
  • File hash: 944153fb9692634d6c70899b83676575

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

25 indicators of compromise · unlock with TL Creds. Compare plans

How LVHN BlackCat breach works

Lehigh Valley Health Network identified suspicious activity on its network on February 6, 2023 and later confirmed ransomware was involved. The ALPHV/BlackCat group breached parts of the network, specifically IT systems related to Delta Medix, a physician group LVHN acquired in 2021. The affected system supported one physician practice in Lackawanna County and held clinically appropriate patient images for radiation oncology treatment and other sensitive information. LVHN publicly disclosed the attack on February 20, 2023 and stated that operations were not disrupted. It also said it refused to pay the ransom. A reported demand of $22 million appears in secondary coverage only.

After LVHN refused payment, ALPHV published stolen data on its dark-web leak site in early March 2023. The leaked material included clinical photographs of breast cancer patients undergoing radiation treatment, which the gang described as nude photos to intensify the extortion. It also included other personal information such as passport scans and questionnaires. The case illustrates double-extortion tactics against healthcare, where patient-image data is used as leverage.

Alleged failures: after the investigation, HHS OCR alleged that LVHN failed to conduct a comprehensive and accurate risk analysis to identify risks and vulnerabilities to electronic PHI (a Security Rule violation) and failed to implement procedures for regularly reviewing records of information system activity. Secondary reporting also states OCR cited untimely breach notifications; this is not confirmed against the HHS release, which returned HTTP 403 to fetch. The resolution is an $800,000 payment and a corrective action plan requiring a comprehensive, accurate risk analysis, with OCR monitoring compliance for three years. OCR counted it as its 22nd ransomware enforcement action. The PHI of 248,359 individuals was involved per OCR. The civil class action, covering about 134,000 people, settled separately for $65 million in 2024.

Generic ALPHV/BlackCat TTPs and IOCs come from the CISA/FBI advisory AA23-353A and are not confirmed to be specific to the LVHN intrusion. No CVE was cited for this incident, and no incident-specific IOCs have been published. BeaconBeagle lookups for the advisory C2 IPs returned HTTP 502 and could not be completed. This record is primarily an enforcement and compliance development.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Persistence

T1136.002 Domain Account

Command and Control

T1219 Remote Access Tools; T1572 Protocol Tunneling

Credential Access

T1555 Credentials from Password Stores; T1557 Adversary-in-the-Middle; T1558 Steal or Forge Kerberos Tickets

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Resource Development

T1586 Compromise Accounts

Reconnaissance

T1598 Phishing for Information

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation for LVHN BlackCat breach

Immediate actions

  • Conduct and document an enterprise-wide, comprehensive and accurate HIPAA Security Rule risk analysis covering all acquired entities such as Delta Medix
  • Hunt for ALPHV/BlackCat tooling: ScreenConnect, SimpleHelp, AnyDesk, Splashtop, Plink, Ngrok, Cobalt Strike and Brute Ratel
  • Block or alert on egress to Mega.nz and Dropbox from servers holding PHI or imaging data

Workarounds

  • Segment radiation oncology and imaging systems from general network and restrict outbound internet access
  • Maintain offline, immutable backups and test restoration

Longer-term hardening

  • Implement regular review of information system activity records (audit logs, access reports, security incident tracking)
  • Integrate acquired entities' IT systems into the central security program and risk management process
  • Harden help-desk identity verification against vishing and SMS social engineering
  • Adopt phishing-resistant MFA to counter adversary-in-the-middle phishing

Affected and fixed versions

  • Lehigh Valley Health Network — Delta Medix IT systems / physician practice network supporting radiation oncology imaging (Lackawanna County, PA)

Timeline of LVHN BlackCat breach

  • LVHN identifies suspicious activity on its network; ransomware later confirmed as locked-ioc-10, affecting a Lackawanna County physician practice network supporting radiation oncology imaging.
  • LVHN publicly discloses the BlackCat attack, states operations were not disrupted and that it refused the ransom demand.
  • ALPHV posts stolen data on its leak site, including clinical photographs of breast cancer patients, after LVHN refuses to pay.
  • CISA/FBI publish #StopRansomware advisory AA23-353A on ALPHV Blackcat TTPs and IOCs (later updated 2024-02-27).
  • LVHN agrees to a $65 million class action settlement covering about 134,000 individuals.
  • Final approval hearing scheduled for the class action settlement.
  • HHS OCR announces an $800,000 settlement and three-year corrective action plan with LVHN over risk analysis and activity-review failures; 248,359 individuals' PHI affected.

Sources cited for LVHN BlackCat breach

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats