BlackCat

ALPHV, also widely known as BlackCat and also referred to as Noberus, was a ransomware-as-a-service operation that emerged in late 2021 and became one of the most prominent leak-site ransomware groups of 2022 through early 2024. It is notable for using Rust-based ransomware with Windows and Linux/VMware ESXi support, enabling affiliates to impact heterogeneous enterprise environments. Reporting and technical analysis have repeatedly linked the operation to personnel, tradecraft, or ecosystem continuity associated with DarkSide and BlackMatter, although direct organizational continuity has not always been independently confirmed. The group operated an affiliate model in which core operators provided the ransomware platform and extortion infrastructure while affiliates conducted intrusions. ALPHV used double extortion as a baseline model by stealing data before encryption and threatening publication on a leak site if victims refused to pay. It also used triple-extortion pressure in some cases, including threats of distributed denial-of-service activity and direct pressure tactics. Public reporting additionally described victim-specific negotiation portals, access-token-based victim handling, outsourced phone pressure, and leak-site publication workflows designed to increase coercive leverage. ALPHV intrusions have involved a broad range of initial access and post-compromise techniques. Observed access vectors include exploitation of internet-facing applications, malvertising-driven delivery chains, abuse of legitimate remote monitoring and management tools, use of stolen or compromised credentials, and access obtained through third parties or contractors. In multiple cases, affiliates used malware such as Nitrogen for initial footholds, then transitioned to hands-on-keyboard activity with tools including Cobalt Strike, Sliver, PsExec, WMIC, BloodHound, CrackMapExec, and network scanners. The group has also been associated with custom exfiltration tooling such as ExMatter/Fendr and with WebDAV-based data theft workflows. Post-exploitation behavior has included privilege escalation, credential abuse, lateral movement across Windows domains, reconnaissance of enterprise networks, service stopping, shadow-copy deletion, recovery inhibition, event-log clearing attempts, and propagation to large numbers of hosts. Technical analyses of ALPHV samples describe configurable features such as embedded PsExec-assisted self-propagation, network discovery, wallpaper changes, ESXi virtual machine termination, and snapshot deletion. Encryption implementations described in reporting include AES or ChaCha20/Salsa20 for file encryption with asymmetric protection of per-file keys, depending on variant and platform. ALPHV targeted organizations globally across North America, Europe, Asia, Africa, and the Americas. Reported victims and targeting patterns show particular impact on the United States and Germany, with activity also affecting Japan and many other countries. Sectors repeatedly associated with ALPHV activity include government-related entities and contractors, healthcare, information technology, communications, manufacturing-related enterprises, and energy/logistics. The group was linked to disruptive attacks on German fuel-distribution companies and was repeatedly observed extorting healthcare organizations and medical device manufacturers, including through threats to expose sensitive patient data. The operation maintained a high tempo through 2022 and 2023 and was consistently ranked among the most active ransomware leak-site actors. By late 2023 and early 2024, however, ALPHV experienced major disruption and controversy. Its leak infrastructure was disrupted in December 2023, and in early 2024 its site again became inaccessible amid allegations from an affiliate that the operators kept a large ransom payment, prompting widespread suspicion of an exit scam. Subsequent overlap between ALPHV victim listings and postings by other groups suggested affiliate migration, reuse of stolen data, or fragmentation of the operation after the disruption. Known aliases include BlackCat, AlphaV, AlphaVM, and Noberus.