Loading story…
Group-IB published research detailing the BlackCat ransomware affiliate program, shedding light on how the operation recruits partners and structures attacks under the ransomware-as-a-service model. The report indicates that BlackCat relies on affiliates to gain access to victim environments and deploy encryption and extortion activity, illustrating the group’s organized criminal business model.
The disclosure adds to understanding of how BlackCat sustains operations through a distributed partner network rather than a single closed team. By outlining the affiliate framework behind BlackCat, the research gives defenders and CISOs clearer insight into the threat actor’s operating model, which can inform detection, access-control hardening, and incident-response planning against ransomware intrusions tied to the group.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Group-IB released a blog post titled "Uncovering the BlackCat Ransomware Affiliate Program," indicating public disclosure of its analysis of BlackCat's affiliate operations. No additional event details are available in the provided reference.
SentinelOne published research on BlackCat (also known as AlphaV/AlphaVM), describing it as a Rust-based ransomware-as-a-service operation targeting Windows and Linux systems. The report detailed its use of a leak site, delivery via tools such as Cobalt Strike or exposed applications, and capabilities including shadow copy deletion, privilege escalation, and VMware/ESXi disruption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
group-ib.com
Open sourceattack.mitre.org
Open sourcesentinelone.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky detailed a BlackCat (`ALPHV`) ransomware intrusion in which attackers gained access with stolen credentials and moved laterally through the victim environment using common post-exploitation tooling, including **Impacket**. The operation followed a familiar double-extortion pattern: the intruders escalated privileges, conducted internal reconnaissance, staged data for exfiltration, and prepared systems for encryption before deploying the BlackCat payload. The incident showed how BlackCat affiliates combined legitimate remote administration activity with widely available offensive tools to blend into normal network traffic and accelerate compromise. The report highlights the group’s continued reliance on credential abuse, lateral movement over Windows administrative protocols, and data theft ahead of ransomware execution, underscoring the risk posed by affiliates that can rapidly turn an initial foothold into enterprise-wide disruption.
Jul 12, 2026
Trend Micro detailed the infection routine used by **Black Basta** ransomware, outlining how the group compromises systems, deploys payloads, and executes encryption across victim environments. The report identifies Black Basta as a rapidly emerging ransomware threat and describes a structured intrusion chain designed to move from initial access to widespread impact inside targeted networks. The research highlights operational behaviors associated with the malware’s deployment, including hands-on intrusion activity and techniques intended to accelerate encryption and disrupt recovery. The findings give defenders a clearer view of how Black Basta attacks unfold in practice, helping security teams prioritize detection of early-stage compromise, lateral movement, and ransomware execution tied to the group’s playbook.
Jul 12, 2026
Three former employees of cybersecurity firms DigitalMint and Sygnia have been indicted for orchestrating a series of BlackCat (ALPHV) ransomware attacks against five U.S. companies between May and November 2023. The accused, including Kevin Tyler Martin and Ryan Clifford Goldberg, allegedly abused their positions as incident response professionals to gain unauthorized access to victim networks, deploy ransomware, steal sensitive data, and demand cryptocurrency ransoms ranging from $300,000 to $10 million. The Department of Justice and FBI state that the group operated as BlackCat affiliates, with at least one successful extortion resulting in a $1.27 million payment from a Tampa medical device manufacturer after its servers were encrypted. The indictment details additional targets, including a Maryland pharmaceutical company, a California doctor's office, a California engineering firm, and a Virginia drone manufacturer, though it is unclear if further ransom payments were made. DigitalMint and Sygnia have both denied organizational involvement, terminated the implicated employees, and are cooperating with law enforcement. The case highlights the risk of insider threats within cybersecurity firms and the sophisticated tactics used by ransomware operators to exploit trusted access for criminal gain.
Jun 29, 2026