Ransomware Attack Hits Medical Consulting Firm PBS
Ransomware Attack on Positive Business Solutions by Play Group
Positive Business Solutions, LLC (PBS), a specialized consulting firm in the medical sector, has recently fallen victim to a ransomware attack orchestrated by the notorious Play ransomware group. This attack has compromised a significant amount of sensitive data, posing a serious threat to the privacy and security of both the company and its clients.
About Positive Business Solutions
Founded in 2009, Positive Business Solutions is dedicated to assisting healthcare providers with their business operations. The firm offers services such as business operations consulting, comprehensive medical billing, financial performance analysis, and practice management. With a mission centered around integrity and professionalism, PBS aims to alleviate the administrative burdens of medical practices, allowing physicians to focus on patient care. The company is recognized for its experienced leadership team, which boasts over 50 years of combined experience in medical practice management, operations, and finance.
Attack Overview
The Play ransomware group, active since June 2022, has claimed responsibility for the attack on PBS. Known for targeting a diverse range of industries, including IT, transportation, and government entities, Play has expanded its reach across North America, South America, and Europe. The group is distinguished by its use of sophisticated attack methods, including exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange. In the case of PBS, the attackers likely exploited these vulnerabilities to gain unauthorized access to the company's systems.
Play Ransomware Group
Play ransomware, also known as PlayCrypt, is characterized by its strategic approach to ransomware attacks. The group employs custom tools and techniques to maintain persistence and evade detection, such as using scheduled tasks, PsExec, and disabling antimalware solutions. Unlike typical ransomware groups, Play does not include an initial ransom demand in its notes, instead directing victims to contact them via email. This approach, combined with their dark web presence, allows them to effectively negotiate ransoms and publicize their attacks.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!