Loading story…
Affiliates of the ALPHV/BlackCat ransomware operation used malvertising campaigns on Google and Bing to impersonate popular business and IT software, including Slack, Cisco AnyConnect, WinSCP, AnyDesk, and TreeSize Free, in an effort to gain initial access to enterprise environments. Victims who clicked the ads were directed to download trojanized installers, often packaged as ISO files, that launched the Nitrogen malware family through DLL sideloading and DLL preloading techniques while displaying benign decoy installers to avoid suspicion. Researchers observed the activity targeting organizations in North America, including technology and non-profit sectors, and said the campaign appeared designed to prepare networks for later ransomware deployment.
Analysis from Sophos and eSentire showed Nitrogen establishing persistence, attempting privilege escalation through a CMSTPLUA UAC bypass, and contacting command-and-control infrastructure over multiple protocols to retrieve follow-on payloads such as Meterpreter and in-memory Cobalt Strike Beacons. eSentire said it began tracking the campaign in June and stopped at least one intrusion before ransomware execution, while Sophos reported remediating infections before attackers could complete hands-on-keyboard activity. The activity was assessed as part of a broader access pipeline leading toward BlackCat ransomware attacks, underscoring how fake software ads are being used to convert routine IT searches into enterprise compromise.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
eSentire reported multiple incidents in October 2023 involving an updated Nitrogen campaign delivered via malicious search ads and fake software installers. In one case, the intrusion progressed to ALPHV/BlackCat ransomware deployment, and the researchers documented new tradecraft including a shift from Pyramid C2 to Sliver, added evasion features, lateral movement, and data exfiltration with Restic.
In July 2023, BlackCat attempted to extort a healthcare network by posting topless images of breast cancer patients. The article cites this as part of BlackCat's broader victimization of healthcare organizations.
On June 21, 2023, eSentire published research describing the Nitrogen campaign and its use of DLL sideloading for command-and-control communication. Later reporting cited eSentire as having first observed the campaign in June and linked it to BlackCat affiliate activity.
Sophos X-Ops said it identified a previously unreported initial-access malware campaign in mid-June 2023 and named it Nitrogen. The campaign used Google and Bing malvertising to impersonate software vendors and deliver trojanized ISO installers to organizations in North America.
The Register reported that ALPHV/BlackCat affiliates were using paid ads impersonating business software such as Slack and Cisco AnyConnect to deliver Nitrogen as an initial-access payload. The article characterized the use of malvertising with Nitrogen as a new tactic observed by eSentire.
Sophos said it detected and remediated observed Nitrogen infections before the attackers could complete further hands-on-keyboard activity or deploy additional payloads. Sophos assessed the campaign was likely intended to stage enterprise environments for ransomware deployment and noted Trend Micro had reported a similar chain ending in BlackCat infection.
eSentire said BlackCat affiliates targeted its customers multiple times through the Nitrogen malvertising campaign and that it stopped at least one attack before ransomware execution. The reporting describes Nitrogen infections as leading toward ALPHV/BlackCat deployment in observed cases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 61 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcetheregister.com
Open sourceesentire.com
Open sourceesentire.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026
Cisco Talos reported that **BlackCat** (also tracked as **ALPHV**) shares infrastructure, tools, filenames, and intrusion tradecraft with the **BlackMatter/DarkSide** ransomware ecosystem, indicating with moderate confidence that at least one BlackMatter affiliate became an early BlackCat operator rather than the group being a simple rebrand. In side-by-side intrusions, Talos observed similar human-operated attack phases including persistent access through tunneling tools, credential theft via **LSASS** dumping, lateral movement with **Impacket `wmiexec`**, **WinRM/PowerShell**, and **RDP**, and domain-wide ransomware deployment from the domain controller’s **NETLOGON** share after scripts such as `apply.ps1`, `defender.vbs`, and `def.vbs` were staged. Talos said BlackCat dwell time exceeded 15 days in one case and noted that more than 30 percent of observed compromises affected U.S.-based organizations. Other reporting and technical analyses describe BlackCat as a **Rust-based ransomware-as-a-service** platform that emerged in late 2021, recruited affiliates from groups including **REvil, BlackMatter, and DarkSide**, and offered operators roughly **80 to 90 percent** of ransom proceeds. Researchers said the malware targets **Windows, Linux, and VMware ESXi** environments, uses double extortion with Tor-based payment portals, and includes capabilities such as **CMSTPLUA** privilege escalation, shadow-copy deletion, service and process termination, and configurable encryption using embedded keys. The overlap with DarkSide-era techniques is reinforced by prior DarkSide analyses showing similar affiliate-driven operations, extortion infrastructure, and malware behaviors, supporting the view that BlackCat grew out of the same criminal talent pool rather than appearing as an entirely separate threat.
Aug 15, 2026