ALPHV / BlackCat
Also known as: ALPHV, BlackCat, Noberus
ALPHV/BlackCat was one of the first major ransomware families written in Rust, with versions for Windows and Linux/VMware ESXi. Its affiliates included Scattered Spider. After an FBI disruption in December 2023, its administrator encouraged affiliates to target hospitals, and healthcare became the most commonly victimised sector among its leaked victims.
- Public attribution
- A ransomware-as-a-service operation; MITRE ATT&CK tracks its Rust-written ransomware as software, first observed in November 2021.
- Active since
- Around 2021
- Targets
- Organisations worldwide
- Healthcare, especially from December 2023
- Tracked by MITRE ATT&CK as software
- S1068 BlackCat
Status: Disrupted by the FBI in December 2023. In March 2024, after the Change Healthcare ransom payment, the operation was widely reported to have shut down in an apparent exit scam.
Notable campaigns
2023FBI disruption
CISA and the FBI issued AA23-353A in December 2023 alongside an FBI operation against the group's infrastructure.
2024Change Healthcare
An ALPHV/BlackCat affiliate attacked Change Healthcare, a US healthcare payment processor, disrupting claims processing nationally (confirmed by its parent company).
Signature ATT&CK techniques
- T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control
- T1047Windows Management Instrumentation
- T1069.002Permission Groups Discovery: Domain Groups
- T1570Lateral Tool Transfer
- T1489Service Stop
- T1490Inhibit System Recovery
- T1486Data Encrypted for Impact
Selected from MITRE ATT&CK's software entry and the cited government advisory.
Defences that work against this actor
- Require MFA on remote access and on help-desk-driven account changes; affiliates often enter with valid credentials.
- Restrict remote management tools such as ScreenConnect to approved instances.
- Harden and back up ESXi hosts; keep their management interfaces off user networks.
- Detect mass service stops and shadow-copy deletion as late-stage ransomware warnings.