Loading malware…
BlackCat, also known as ALPHV and Noberus, is a Rust-based ransomware family that emerged in December 2021. Developed and operated by ALPHA SPIDER as a ransomware-as-a-service platform, it provides variants targeting Windows, Linux, and VMware ESXi environments. Affiliates compromise victim networks and deploy the ransomware in exchange for a share of ransom proceeds. Its operations combine file encryption with threats to publish stolen information, supported by searchable leaked-data repositories.
BlackCat can replicate across connected servers using PsExec, enabling deployment throughout compromised networks. The platform offered frequently rebuilt payloads to evade antivirus detection. Affiliates have obtained access through compromised credentials and exploitation of vulnerable enterprise software, including Ivanti Cloud Services Appliance and publicly exposed Veritas Backup Exec installations. Intrusions have involved credential theft, network reconnaissance, persistent remote access, and data exfiltration using separate tools such as Cobalt Strike, SystemBC, reverse-SSH utilities, and cloud-storage clients. These supporting activities are distinct from the ransomware payload's functionality.
BlackCat has been deployed by multiple criminal groups, including Scattered Spider, Pistachio Tempest/FIN12, and Vanilla Tempest. Victims span multiple industries, including healthcare and education; the Change Healthcare attack caused substantial disruption to U.S. healthcare operations. Law enforcement disrupted the ALPHV operation in December 2023, and it ceased operating by March 2024, after which affiliates migrated to other ransomware programs.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
After obtaining code execution on the CSA server, Threat Actor 1 exploited a vulnerability described as PwnKit to temporarily obtain root privileges and create a new UID 0 account. The exploitation paragraph identifies it as CVE-2021-40347, while the linked hunting article identifies PwnKit as CVE-2021-4034.
Threat Actor 1 leveraged CVE-2021-44529 in the Ivanti EPM Cloud Services Appliance to execute arbitrary code as the limited-permission user nobody. The article states that a patch was available before exploitation on December 2, 2021.
Following network discovery and vulnerability scanning, Threat Actor 1 attempted to exploit CVE-2021-21972, described as a remote code execution vulnerability in a vCenter Server plugin that permits commands to run with unrestricted privileges.
The vulnerabilities, identified as CVE-2021-27876, CVE-2021-27877 and CVE-2021-27878, existed due to a flaw in the SHA authentication scheme used by Backup Exec.
The vulnerabilities, identified as CVE-2021-27876, CVE-2021-27877 and CVE-2021-27878, existed due to a flaw in the SHA authentication scheme used by Backup Exec.
The vulnerabilities, identified as CVE-2021-27876, CVE-2021-27877 and CVE-2021-27878, existed due to a flaw in the SHA authentication scheme used by Backup Exec.
At-Bay’s Cyber Research team confirmed that BlackCat (aka Alphv) successfully exploited the GoAnywhere MFT vulnerability (CVE-2023-0669) against a U.S. business in February 2023. Clop had previously exploited the same vulnerability and claimed to have compromised over 100 organizations. | At-Bay’s Cyber Research team confirmed that BlackCat has successfully exploited the GoAnywhere MFT vulnerability and attacked a U.S. business in February 2023.
HTC Global Services has confirmed it suffered a cyber attack after the BlackCat ransomware group (also known as ALPHV) recently leaked photos of what it claimed to be data stolen from the IT services and business consulting company.
BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
In this incident, we identified the exploitation of CVE-2021-31207. This vulnerability abuses the New-MailboxExportRequest PowerShell command to export the user mailbox to an arbitrary file location, which could be used to write a web shell on the Exchange Server. | BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model.
Log4Shell (CVE-2021-44228) Disclosed on December 9th, 2021, Log4Shell (CVE-2021-44228) is one of the more memorable recent supply chain vulnerabilities with widespread industry impact. This was a critical remote code execution vulnerability in Apache Log4J, a Java logging library utility used by many applications.
CVE-2024–1709 is an Authentication Bypass Vulnerability in ConnectWise ScreenConnect instances caused by inadequate validation of URLs and insufficient access control, and it is a high severity vulnerability with confirmed real world exploitation by the BlackCat/Alphv ransomware gang and the Kimsuky group.
An analysis of ‘exp.exe’ indicated that it is a privilege escalation tool based on the exploitation of CVE-2022-24521 – a vulnerability in the Windows Common Log File System (CLFS) Driver, known to be used by several ransomware groups.
Afin de se latéraliser, les opérateurs du MOA ont tenté, sans succès, d’exploiter les vulnérabilités PrintNightmare (CVE-2021-34527), BlueKeep (CVE-2019-0708), puis ZeroLogon (CVE-2020-1472) via l’outil Mimikatz.
“Alphv (AKA BlackCat, Noberus) is a ransomware variant that has been active since at least November 2021 and operates using the double extortion method – where victim data is stolen and leaked if a ransom is not paid. Alphv operates as a RaaS…”
“Alphv (AKA BlackCat, Noberus) is a ransomware variant that has been active since at least November 2021 and operates using the double extortion method – where victim data is stolen and leaked if a ransom is not paid. Alphv operates as a RaaS…”
“Alphv (AKA BlackCat, Noberus) is a ransomware variant that has been active since at least November 2021 and operates using the double extortion method – where victim data is stolen and leaked if a ransom is not paid. Alphv operates as a RaaS…”
“Alphv (AKA BlackCat, Noberus) is a ransomware variant that has been active since at least November 2021 and operates using the double extortion method – where victim data is stolen and leaked if a ransom is not paid. Alphv operates as a RaaS…”
“Alphv (AKA BlackCat, Noberus) is a ransomware variant that has been active since at least November 2021 and operates using the double extortion method – where victim data is stolen and leaked if a ransom is not paid. Alphv operates as a RaaS…”
“Alphv (AKA BlackCat, Noberus) is a ransomware variant that has been active since at least November 2021 and operates using the double extortion method – where victim data is stolen and leaked if a ransom is not paid. Alphv operates as a RaaS…”
Ransomware groups—including BlackCat/ALPHV, Black Basta, RansomHub, and Dark Angels—are increasingly targeting VMware ESXi...
20 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Rapid Brigantine ... a cybercriminal group that has deployed ransomware families such as Rhysida, BlackCat, and Quantum Locker.
Rapid Brigantine ... a cybercriminal group that has deployed ransomware families such as Rhysida, BlackCat, and Quantum Locker.
ALPHA SPIDER is the adversary behind the development and operation of the Alphv ransomware as a service (RaaS).
This latest attack follows a $22 million ransom payment made by Change Healthcare to the BlackCat group, aimed at preventing a data leak and restoring their systems.
One of the Cobalt Strike C2 IP addresses identified in this activity matches an IP address mentioned in a Sophos X-Ops report, where a similar infection chain resulted in an Ambitious Scorpius (BlackCat) ransomware attack.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
“Scattered Spider obtained initial access before one of the aforementioned groups was observed using ransomware for encryption.”
The ransomware deletes all volume shadow copies using the vssadmin.exe utility ... The binary disables Automatic Repair using the bcdedit tool | The ransomware deletes all volume shadow copies using the vssadmin.exe utility ... There is also a second process that is responsible for deleting all volume shadow copies with wmic
296 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family mentioned as previously deployed by Rapid Brigantine and its aliases. It is background context for the actor attribution, not an observed payload in the investigated incident.
Ransomware named in a background example of misconduct by a ransomware negotiator. The article provides no technical details about the malware and does not connect it to Edward Dubrovsky's case.
Ransomware cited as a payload distributed using compromised administrative credentials and Group Policy mechanisms. The article associates it with Vanilla Tempest and education-sector targeting, but marks the campaign details and attribution as unverified.
Appears only in background discussion of ransomware affiliates moving to Qilin.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.