In this edition of the Halcyon video/podcast series Last Month in Security, host Anthony M. Freed and panelists Ben Carr and Ryan Golden are joined by Halcyon CEO John Miller to continue our examination of the recent Change Healthcare attack that crippled healthcare payment processes across the country.

We also delve into recent takedowns of two of the most prolific ransomware gangs – LockBit and BlackCat/ALPHV - and whether law enforcement actions will have any lasting effect on the onslaught of attacks.

And we touch on the dual nature of some of today’s ransomware attacks that serve a geopolitical strategy and offer plausible deniability for adversarial nations in addition to a revenue stream for criminal actors.

Parent company UnitedHealth Group estimates the cost of remediating the February ransomware attack Q1-2024 is $872 million, and said it expects the attack on Change Healthcare will cost $1.6 billion.

Those numbers are insane. But oh good, here comes the government to the rescue?
Senator Mark Warner (D-VA) has proposed legislation dubbed the Health Care Cybersecurity Improvement Act, that would require some healthcare providers and technology vendors to implement minimum cybersecurity standards.

Meanwhile, DHS published healthcare-specific Cybersecurity Performance Goals, and HHS is planning two regulatory changes that will implement cybersecurity standards for Medicare and Medicaid participation by way of updated HIPAA data security rules after more than 152M people were impacted in the attack.

And to make things more complicated, RansomHub – who may be a rebrand of BlackCat/ALPHV – is claiming to be in possession of data stolen from Change Healthcare and is further extorting the company.

But we did have some major takedowns by law enforcement against LockBit and BlackCat/ALPHV that may have contributed to a notable decline in attacks in the first quarter of 2024.

Yet, even after these actions, LockBit attacked Trans-Northern Pipelines, Prudential Financial, and LoanDepot (to name a few), and BlackCat/ALPHV hit Change Healthcare months after law enforcement takedown attempt, calling into question whether law enforcement alone is the right path for dealing with ransomware attacks.

There is mounting evidence that some of these ransomware operators may be acting as proxies for adversarial nations like Russia and China. The dual nature of a subset of ransomware attacks conveniently provides these nations with plausible deniability.

There is evidence of overlap between cybercrime and APT operations including shared attack infrastructure and tooling between cybercriminals and nation-state operators, and Chainalysis found that 74% of all revenue from ransomware attacks in 2021 went to attackers in Russia.
So why are Western nations afraid to call out the blatant connection between cybercriminal and nation-state operations? Do we need to invoke something like Executive Order 13224 where we designate some ransomware attacks as nation-state sponsored terrorism?

‍About Our Guest:

Jon Miller is the CEO and Co-founder of Halcyon and has spent 25+ years working in the cybersecurity industry. Prior to Halcyon, Miller was the CEO & Co-founder of Boldend, a next-generation defense contractor focused on building offensive tools for the US Government.
Before his work at Boldend, Miller held the title of Chief Research Officer of Cylance (now Blackberry) where he focused on malware and product efficacy. Prior to Cylance, Miller was employee number 70 at Accuvant (now Optiv) where he helped build and lead the largest technical consultancy at the time Accuvant LABS, working with over 95% of the Fortune 500 as an offensive security expert.  
Your Hosts:

Anthony M. Freed, Halcyon Director of Research and Communications

Ben Carr, Halcyon Advisory CISO

Ryan Golden, Halcyon Chief Marketing O

Experts disagree as to whether AI is the game changer for humanity as promised or will spell the end of us all – it just depends on who you ask. AI/ML have been in use in security solutions for some time, and it hasn’t killed anyone yet (mostly).

But are there still ethical considerations that arise when applying AI/ML in cybersecurity? Yes, because in a world increasingly reliant on AI/ML-powered solutions for cybersecurity, we still need to ensure there is transparency and accountability for those who develop the algorithms
that run our detection engines.

In this episode of Security Gets Serious with Ben Carr, host Ben Carr sits down with a pioneer in the application of AI/ML in solving security challenges, Ryan Permeh, partner at technology investment group Syn Ventures (https://www.synventures.com/).

Permeh has been a leader in security innovation for several decades and has a storied career in both offensive and defensive security, helping pioneer the use of AI/ML to detect and defeat novel threats.

He discovered and was the primary analyst investigating the “Code Red” computer worm and contributed to many other analyses of significant threats over his career. 

Permeh was Co-Founder and former Chief Scientist at Cylance (acquired by Blackberry $1.4b in 2020) and led development of the architecture behind Cylance’s mathematical engine and groundbreaking approach to security that disrupted the industry and introduced Next-Generation
Antivirus (NGAV).

Prior to co-founding Cylance, he served as Chief Scientist for over two decades at McAfee, focusing on technology strategy. Prior to that, Permeh was a Distinguished Engineer at eEye Digital Security where he focused on building security assessment tools.

Permeh has published numerous articles, papers and books, and is a frequent speaker at conferences around the world on the topics of security, privacy, AI/ML, and entrepreneurship.

His research has led to numerous innovations in both offensive and defensive security technology, and he has more than 20 patents in the security and data science fields.

-

Your Host: Ben Carr, Halcyon Advisory CISO

Welcome to the inaugural episode of "Security Gets Serious," where we delve into the world of cybersecurity with industry experts. In Episode 001, our host Ben Carr, shares invaluable insights into the challenges faced by CISOs in today's digital landscape.

As organizations navigate increasingly complex cyber threats, understanding the role of a CISO is crucial. Ben Carr provides a firsthand account of the strategic decisions, risk management strategies, and technological advancements necessary to safeguard sensitive data and mitigate cyber risks effectively.

Tune in now to gain expert knowledge and actionable strategies from Ben Carr and stay tuned for more episodes of "Security Gets Serious." Don't forget to like, share, and subscribe for future updates on cybersecurity insights and best practices.

Welcome to our new series "Last Month in Security", where we bring you the latest insights and updates from the frontlines of cyber defense. In this episode, we delve into the key events and trends that shaped the past month in cyber security.

From major data breaches to emerging threats, we provide a comprehensive overview of the challenges faced by individuals and organizations in today's digital landscape. Our expert analysis offers valuable perspectives on the evolving tactics of cybercriminals and the strategies employed by defenders to stay ahead of the curve.

Join us as we explore the latest advancements in cyber defense technologies and discuss proactive measures to enhance your digital security posture. Whether you're a seasoned IT professional or a concerned citizen looking to safeguard your online presence, this video has something for everyone.

Stay informed, stay vigilant, and together, let's fortify our digital frontier against emerging threats. Watch now and empower yourself with the knowledge needed to navigate the complexities of cyber security.

Welcome to our new series "Last Month in Security", where we bring you the latest insights and updates from the frontlines of cyber defense. In this episode, we delve into the key events and trends that shaped the past month in cyber security.

From major data breaches to emerging threats, we provide a comprehensive overview of the challenges faced by individuals and organizations in today's digital landscape. Our expert analysis offers valuable perspectives on the evolving tactics of cybercriminals and the strategies employed by defenders to stay ahead of the curve.

Join us as we explore the latest advancements in cyber defense technologies and discuss proactive measures to enhance your digital security posture. Whether you're a seasoned IT professional or a concerned citizen looking to safeguard your online presence, this video has something for everyone.

Stay informed, stay vigilant, and together, let's fortify our digital frontier against emerging threats. Watch now and empower yourself with the knowledge needed to navigate the complexities of cyber security.