Alphv (BlackCat)
ALPHV, also referred to as BlackCat, is a ransomware family operated as a rentable ransomware offering in underground cybercrime communities. The provided content states it was used to encrypt victim networks in intrusions attributed to two former cybersecurity firm employees and a third suspect, who allegedly hacked US companies, stole data, encrypted systems, and demanded multi-million-dollar ransoms. Victims named in the content include a medical device company in Tampa, a pharmaceutical company in Maryland, a drone manufacturer in Virginia, and an engineering company and a doctor’s office in California. In one cited case, the attackers demanded $10 million and received $1.27 million. The content also notes that LockBit 3.0 employed some features known to be used by BlackMatter and ALPHV/BlackCat ransomware, but does not further detail ALPHV’s technical capabilities. US and European partners seized ALPHV servers in December 2023.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Scattered Spider is known to exploit CVE-2015-2291 which is a vulnerability in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys) that allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted ... IOCTL call.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
AlphV (BlackCat) is a ransomware-as-a-service (RaaS) platform used to encrypt victim networks and demand large ransom payments. It is known for being highly customizable and for its use in high-profile attacks, including double extortion tactics (data theft and encryption).
Ransomware family referenced as having features similar to those present in LockBit 3.0.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.