PILLAR 1: INTAKE & CASE MANAGEMENTFRE 901 CHAIN OF CUSTODY CERTIFIED
Incident Intake, Organization Registry & Case Vault
INC-2026-8841CRITICAL
Mercy General Health System
LockBit 3.0 (Black)
INC-2026-9012CRITICAL
Apex Global Financial Group
BlackCat / ALPHV (Rust)
INC-2026-7492HIGH
Precision Dynamics Aerospace
Royal Ransomware
INC-2026-5520MEDIUM
Heritage Energy Pipeline Operations
WannaCry 2.0 (MS17-010)
INC-2026-8841STATUS: RECOVERING
Regional Healthcare EHR & PACS Outage
Mercy General Health System · Healthcare / Critical Infrastructure · Lead: Elena Rostova, CISSP
Ransom Demand
$1.80M (BTC)
INCIDENT SUMMARY & SCOPE
Mass ransomware deployment via compromised Domain Admin credentials. Hyper-V cluster and patient billing SQL databases encrypted with .lockbit extension. Shadow copies deleted via vssadmin. Immutable S3 backups verified intact.
Darknet Negotiation Portal:
http://lockbitaptc2xnk7b5yvh7y5vxsq.onion/chat/8841
Bitcoin Wallet:
bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
INTAKE FORENSIC PROFILE
Threat Actor Attribution:LockBit Supporter Gang (FIN12 Affiliate)
AI Attribution Confidence:97.4%
Data Exfiltration Status:CONFIRMED
Primary Recovery Path:BACKUP_ONLY