RansomwareATT&CK S1068
BlackCat (ALPHV)
Also known as: ALPHV, Noberus
BlackCat, also known as ALPHV, was a ransomware-as-a-service family written in Rust that could encrypt Windows, Linux and VMware ESXi systems. A December 2023 joint advisory described its affiliates' use of social engineering and stolen credentials, and the healthcare sector was a frequent victim, including Change Healthcare in February 2024.
- Public attribution and associated actors
- Run as ransomware-as-a-service; MITRE ATT&CK lists it as used by Scattered Spider among its affiliates.As publicly reported:ALPHV / BlackCatScattered Spider
- First seen
- Around 2021
- Platforms
- Windows, Linux, VMware ESXi
- MITRE ATT&CK software entries
- S1068 BlackCat
Status: The US Department of Justice announced an FBI-led disruption of the operation in December 2023 (reported).
How it spreads or gets in
- Affiliates used stolen credentials, social engineering of help desks and exploitation of remote services (CISA AA23-353A).
- Spread inside networks with WMI, remote services and lateral tool transfer.
Key behaviours
- Encrypted virtual machine hosts as well as Windows servers.
- Bypassed User Account Control and deleted recovery options.
- Could wipe disk content and change desktop wallpaper with the ransom note.
ATT&CK techniques
- T1047Windows Management Instrumentation
- T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control
- T1570Lateral Tool Transfer
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
- T1561.001Disk Wipe: Disk Content Wipe
- T1491.001Defacement: Internal Defacement
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on help-desk password and MFA resets followed by unusual logons.
- Monitor hypervisor management interfaces for unexpected logons and mass VM shutdowns.
- Detect WMI process creation across many hosts from one source.
Defences that work
- Verify identity strongly before help-desk resets of passwords or MFA.
- Use phishing-resistant MFA, especially for administrators.
- Isolate hypervisor management networks and back up VMs offline.
- Keep offline, tested backups.