Threat video1:00
BlackCat LVHN Breach HHS Settlement: Detection & IOCs
HHS OCR's $800K LVHN settlement covers a 2023 BlackCat breach of 248,359 individuals' PHI; 9 detection rules, 25 IOCs and a free Splunk SPL rule.
Read the full threat intel for BlackCat LVHN Breach HHS Settlement: Detection & IOCs →
Chapters
- 0:00The hookHHS settles LVHN's ransomware investigation today.
- 0:05The storyFebruary 2023: LVHN detected ransomware.
- 0:12Attack pathStolen credentials gave attacker access.
- 0:25AttributionAttributed to ALPHV.
- 0:29Indicators of compromise13 indicators to hunt: 5 IPs, 2 domains and 2 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation3 steps now: Conduct and document an enterprise-wide, comprehensive and accurate HIPAA Security.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00HHS settles LVHN's ransomware investigation today.
0:05February 2023: LVHN detected ransomware.
0:09BlackCat leaked patient images.
0:12Stolen credentials gave attacker access.
0:15They installed remote access tools.
0:17Dumped credentials, stole imaging data.
0:20Deployed ransomware; leaked photos as extortion.
0:25Attributed to ALPHV. Confidence: high.
0:3013 indicators to hunt: 5 IPs, 2 domains and 2 SHA-256 hashes, and more.
0:3812 ATT&CK techniques, from reconnaissance to impact.
0:433 steps now: Conduct and document an enterprise-wide, comprehensive and accurate HIPAA Security.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.