Bottom line: BlackFile's affiliate groups continue to target victims in the financial and medical technology sectors.
What's happening: BlackFile's four affiliate groups, including the "BlackCat" and "BlackHawk" groups, have been targeting victims in the financial and medical technology sectors since May 2022. Google has confirmed that several potential victims, including medical technology organizations such as Children's Health System of Texas, received new extortion demands last week. The attacks are believed to be related to BlackFile's earlier attacks on companies such as Bank of America and Citigroup.
What to do: Security leaders should monitor the BlackFile threat landscape and implement additional security controls to prevent lateral movement in case of a breach. Organizations should also review their incident response plans to ensure they are prepared to respond to potential attacks.