Loading story…
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable Microsoft Exchange servers, including CVE-2021-31207 in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting ASPX web shells, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including MobaXterm. In one case, a tampered libeay32.dll was downloaded to sideload Cobalt Strike, while post-compromise activity included credential theft through Mimikatz or LSASS dumping with Process Hacker, along with account and network discovery using SoftPerfect Network Scanner, NetScan, BloodHound, Inveigh, and CrackMapExec.
Before encryption, the operators compressed targeted data with WinRAR or 7-Zip and exfiltrated files through rclone, MEGAsync, and in some cases FileZilla or WinSCP. Lateral movement and staging were carried out over SMB, including use of SysVol shares and local paths such as C:\Windows\debug, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including --safeboot and --sleep-restart, underscoring the group’s continued ability to target Windows, Linux, and VMware ESXi environments while pairing encryption with data theft and Tor-based extortion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
BlackCat/ALPHV, a Rust-based ransomware-as-a-service family targeting Windows, Linux, and VMware ESXi systems, appeared in November 2021.
MITRE ATT&CK published the software entry S0488 for CrackMapExec, a tool later referenced in BlackCat intrusion activity for credential dumping and lateral movement.
SecurityScorecard reported a newer BlackCat version that introduced previously undocumented command-line parameters including --safeboot and --sleep-restart, indicating updated ransomware functionality.
Before encryption in the SecurityScorecard investigation, the attackers compressed targeted files with WinRAR or 7-Zip and exfiltrated data using rclone and MEGAsync, with FileZilla and WinSCP also observed in the environment.
In the SecurityScorecard case, the operators dumped credentials with Mimikatz or an LSASS dump via Process Hacker, moved laterally over RDP, and used SoftPerfect Network Scanner to identify additional targets.
SecurityScorecard described a DFIR investigation in which BlackCat operators gained access through an unpatched Microsoft Exchange server containing multiple web shells, then installed tools including MobaXterm, Process Hacker, and cURL.
The ransomware was staged on SysVol Share and in C:\Windows\debug, permissions were adjusted with icacls.exe and net share, and BlackCat then deleted shadow copies, disabled recovery, cleared logs, and encrypted files while dropping a ransom note claiming data theft.
The attackers conducted account and network discovery with tools including NetScan, BloodHound, CrackMapExec, and Inveigh, then spread modified DLLs to remote machines over SMB.
After web shell access, the attackers used PowerShell to download a tampered libeay32.dll from 5[.]255[.]100[.]242 and executed it with rundll32.exe to load a Cobalt Strike stager.
In the Trend Micro-investigated incident, attackers gained initial access to a Microsoft Exchange environment by exploiting CVE-2021-31207 in ProxyShell-style activity and wrote ASPX web shells to the server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcetrendmicro.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026
Cisco Talos reported that **BlackCat** (also tracked as **ALPHV**) shares infrastructure, tools, filenames, and intrusion tradecraft with the **BlackMatter/DarkSide** ransomware ecosystem, indicating with moderate confidence that at least one BlackMatter affiliate became an early BlackCat operator rather than the group being a simple rebrand. In side-by-side intrusions, Talos observed similar human-operated attack phases including persistent access through tunneling tools, credential theft via **LSASS** dumping, lateral movement with **Impacket `wmiexec`**, **WinRM/PowerShell**, and **RDP**, and domain-wide ransomware deployment from the domain controller’s **NETLOGON** share after scripts such as `apply.ps1`, `defender.vbs`, and `def.vbs` were staged. Talos said BlackCat dwell time exceeded 15 days in one case and noted that more than 30 percent of observed compromises affected U.S.-based organizations. Other reporting and technical analyses describe BlackCat as a **Rust-based ransomware-as-a-service** platform that emerged in late 2021, recruited affiliates from groups including **REvil, BlackMatter, and DarkSide**, and offered operators roughly **80 to 90 percent** of ransom proceeds. Researchers said the malware targets **Windows, Linux, and VMware ESXi** environments, uses double extortion with Tor-based payment portals, and includes capabilities such as **CMSTPLUA** privilege escalation, shadow-copy deletion, service and process termination, and configurable encryption using embedded keys. The overlap with DarkSide-era techniques is reinforced by prior DarkSide analyses showing similar affiliate-driven operations, extortion infrastructure, and malware behaviors, supporting the view that BlackCat grew out of the same criminal talent pool rather than appearing as an entirely separate threat.
Aug 15, 2026
Kaspersky detailed a BlackCat (`ALPHV`) ransomware intrusion in which attackers gained access with stolen credentials and moved laterally through the victim environment using common post-exploitation tooling, including **Impacket**. The operation followed a familiar double-extortion pattern: the intruders escalated privileges, conducted internal reconnaissance, staged data for exfiltration, and prepared systems for encryption before deploying the BlackCat payload. The incident showed how BlackCat affiliates combined legitimate remote administration activity with widely available offensive tools to blend into normal network traffic and accelerate compromise. The report highlights the group’s continued reliance on credential abuse, lateral movement over Windows administrative protocols, and data theft ahead of ransomware execution, underscoring the risk posed by affiliates that can rapidly turn an initial foothold into enterprise-wide disruption.
Jul 12, 2026