Executive Summary
In 2023, former cybersecurity professionals Ryan Goldberg and Kevin Martin exploited their expertise to conduct ransomware attacks using the ALPHV/BlackCat variant. Over a six-month period, they targeted multiple U.S. organizations, including a Florida medical company, a Maryland pharmaceutical firm, a California doctor's office, a California engineering company, and a Virginia drone manufacturer. Their actions led to significant operational disruptions and financial losses, with at least one victim paying a $1.3 million ransom. (justice.gov)
This case underscores the alarming trend of insiders leveraging privileged access and knowledge for malicious purposes. It highlights the critical need for robust internal controls, continuous monitoring, and stringent access management to mitigate insider threats within organizations.
Why This Matters Now
The incident emphasizes the growing risk of insider threats in cybersecurity, where trusted professionals misuse their access for personal gain. Organizations must prioritize comprehensive security measures to detect and prevent such internal exploits.
Attack Path Analysis
The attackers gained initial access by exploiting their insider positions to obtain valid credentials. They escalated privileges by leveraging their knowledge of internal systems to access higher-level accounts. Using these elevated privileges, they moved laterally across the network to identify and access critical systems. They established command and control channels to maintain persistent access and manage the deployment of ransomware. Sensitive data was exfiltrated to external servers prior to encryption. Finally, they deployed the ALPHV/BlackCat ransomware to encrypt data and extort payments from the victims.
Kill Chain Progression
Initial Compromise
Description
The attackers exploited their insider positions to obtain valid credentials, granting them initial access to the network.
MITRE ATT&CK® Techniques
Valid Accounts
Phishing
Data Encrypted for Impact
Application Layer Protocol
Command and Scripting Interpreter
Obfuscated Files or Information
File and Directory Discovery
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Malicious Software Prevention
Control ID: 6.4.3
NYDFS 23 NYCRR 500 – Cybersecurity Program
Control ID: 500.02
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
HIPAA – Risk Analysis
Control ID: 164.308(a)(1)(ii)(A)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Direct ransomware targeting with patient data exposure, encrypted traffic vulnerabilities, and HIPAA compliance failures creating critical healthcare infrastructure risks.
Pharmaceuticals
Ransomware attacks compromising drug development data, supply chain disruption, and regulatory compliance violations through lateral movement and exfiltration.
Computer/Network Security
Insider threat exploitation by security professionals using zero trust segmentation gaps and privileged access for ransomware deployment and negotiation fraud.
Financial Services
Ransomware negotiator compromise enabling payment extortion, PCI compliance violations, and multicloud visibility gaps exposing financial transaction data.
Sources
- Former incident responders sentenced to 4 years in prison for committing ransomware attackshttps://cyberscoop.com/incident-responders-ryan-goldberg-kevin-martin-sentenced-ransomware/Verified
- Two Americans Who Attacked Multiple U.S. Victims Using ALPHV BlackCat Ransomware Sentenced to Prisonhttps://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentencedVerified
- Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Varianthttps://www.justice.gov/opa/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variantVerified
- Profile: ALPHV/BlackCat Ransomwarehttps://www.cyber.gc.ca/en/guidance/profile-alphvblackcat-ransomwareVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attackers' ability to escalate privileges, move laterally, and exfiltrate data by enforcing strict segmentation and controlled access policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attackers' initial access may have been limited to specific segments, reducing their ability to reach critical systems.
Control: Zero Trust Segmentation
Mitigation: The attackers' ability to escalate privileges could have been constrained, limiting their access to higher-level accounts.
Control: East-West Traffic Security
Mitigation: The attackers' lateral movement may have been restricted, reducing their ability to access critical systems.
Control: Multicloud Visibility & Control
Mitigation: The attackers' command and control channels could have been detected and disrupted, limiting their persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: The attackers' data exfiltration efforts may have been blocked, reducing the risk of data loss.
The deployment of ransomware could have been limited to specific segments, reducing the overall impact.
Impact at a Glance
Affected Business Functions
- Patient Data Management
- Pharmaceutical Research
- Engineering Design
- Drone Manufacturing
Estimated downtime: 21 days
Estimated loss: $1,300,000
Patient records, proprietary pharmaceutical research data, engineering schematics, and drone design documents.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and limit lateral movement.
- • Deploy East-West Traffic Security controls to monitor and restrict internal traffic flows.
- • Utilize Multicloud Visibility & Control solutions to detect and respond to anomalous activities across environments.
- • Enforce Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
- • Establish Threat Detection & Anomaly Response mechanisms to identify and mitigate malicious behaviors promptly.
