In a recent alert by the Cybersecurity & Infrastructure Security Agency (CISA), authorities warn that Daixin threat actors are actively targeting the United States healthcare industry with devastating ransomware attacks. The Daixin Team is an evolving ransomware and data extortion group that has been targeting the healthcare sector since June 2022. Data exfiltrated from their ransomware operations includes personal identifiable information (PII) and patient health information (PHI), both of which are commonly used as leverage if the victim doesn’t pay the demanded ransom. In previous cases, Daixin threat actors gained access through vulnerable VPN servers by utilizing phished login credentials. Once inside the victim network, threat actors deployed several web shells and scripts to perform credential harvesting, followed by accessing the vCenter Server and resetting all user credentials. Analysis of Daixin ransomware attacks has shown that these threat actors utilize a similar source code structure to that of Babuk Locker. CTIX will continue to monitor threat actor activity worldwide and provide additional updates accordingly.