Last Week in Ransomware: 03.11.2024

This report summarizes recent high-impact ransomware activity: Phobos campaigns against U.S. critical infrastructure prompting a joint FBI/CISA advisory; a reported $22M Bitcoin payment tied to BlackCat/ALPHV and subsequent allegations of an exit scam; and Rhysida's sale of exfiltrated data from Lurie Children's Hospital. It highlights common attacker TTPs such as credential theft, lateral movement, data exfiltration and backup destruction (double extortion), and emphasizes severe disruptions to healthcare and critical services.