Possible China link to Change Healthcare ransomware attack

Menlo Security links an ALPHV/BlackCat affiliate calling itself "Notchy" to the February 21 ransomware intrusion that disrupted Change Healthcare and impaired pharmacies nationwide; the attack reportedly resulted in a ~$22M Bitcoin ransom and forum evidence of tool purchases (Cobalt Strike, SmartScreen Killer), with Menlo suggesting possible ties between the affiliate and China-backed cybercrime groups based on dark-web and HUMINT findings.