CISA • 3w
LockBit 5.0, StealBit, Insight Hospital, and Capital Health: Double-Extortion Healthcare Campaigns
LockBit ransomware operators, employing the evolved LockBit 5.0 ("ChuongDong") variant and the StealBit exfiltration tool, have executed successful double-extortion campaigns against Insight Hospital and Medical Center and Capital Health. The Insight Hospital breach involved the exfiltration of ~200 GB of sensitive PHI/PII, including Social Security numbers and treatment records. Capital Health suffered a massive 7 TB data theft, resulting in a $4.5 million legal settlement. These attacks leverage advanced evasion techniques, including EtwEventWrite API patching and cross-platform payloads (Windows, Linux, and ESXi), to bypass modern security defenses and leverage stolen data on dark web leak sites to maximize extortion pressure.
Links:Cisa, Trmlabs, Breach, Dexpose, Hipaajournal, Cloudian, Claimdepot, Thelyonfirm, Defensorum, Bankinfosecurity, Niksun, Vectra, Medium, Ransomware, Proteuscyber, Securityaffairs, Comparitech, techjacksolutions.com, Home, Thehackernews, Netbankaudit, Akamai, Ic3, Lawfaremedia, Justice, Breachsense, Ransomfeed, Cybercrime, Masonllp, Ahdootwolfson, Thecyberexpress, Areteir, Aha, Research, Guidepointsecurity, Industrialcyber, Blackfog, Cyberdaily, Therecord, Cbc, Forbes •