Last Week in Ransomware: 05.06.2024

This briefing summarizes recent ransomware activity: a major February attack on Change Healthcare (UnitedHealth subsidiary) prompting scrutiny from 22 state Attorneys General, a mid-April ransomware event forcing Coffee County, GA to disconnect from the GARViS voter registration system as a precaution, and a joint FBI/CISA/EU alert on the Akira ransomware family — a RaaS active since 2023 that has hit over 250 organizations (~$42M extorted), targets healthcare and critical infrastructure, uses double extortion, and exploits VPN credentials and vulnerabilities in VMware and Cisco products.