Loading story…
Researchers and U.S. authorities warned that BlackCat/ALPHV ransomware operators and affiliates have repeatedly gained access to organizations through exposed remote administration paths, social engineering, and vulnerable internet-facing services. Microsoft documented the group's use of stolen credentials, compromised accounts, and a broad affiliate model, while CISA highlighted the growing abuse of remote monitoring and management (RMM) tools for stealthy persistence, lateral movement, and ransomware deployment.
SecurityScorecard tied those tactics to incidents affecting a U.S. county government and a vendor that manages local-government records, where investigators found signs of malicious SSH activity, exposed Telnet and OpenSSH services, possible use of ConnectWise/ScreenConnect, and suspicious transfers consistent with command-and-control or data exfiltration. In the records-management case, analysts assessed with moderate confidence that the disruption was caused by BlackCat ransomware or an attempted BlackCat attack, citing communications with infrastructure linked to prior malicious activity and behavior resembling BlackCat's exfiltration methods.
TTPs, infrastructure, and targeting history in one profile.
16 events from the most recent confirmed update back to the earliest known activity.
CISA warned that malicious actors were increasingly exploiting legitimate remote monitoring and management software, including ConnectWise, for initial access. SecurityScorecard cited this warning as relevant to the vendor intrusion scenario.
A publicly accessible login page was available at the vendor's ConnectWise-related subdomain. The report says this suggested the organization's remote desktop service was exposed and could have been used with compromised credentials.
As of this date, some county customers' records remained inaccessible because of the vendor incident. This showed the operational impact continued into January.
A file named ConnectWiseControl.Client.exe containing the vendor subdomain connect.[vendordomain].com first appeared on VirusTotal. SecurityScorecard said the artifact indicated installation of a ConnectWise remote desktop client that may have enabled remote access.
News reporting stated that the records-management service disruption resulted from an unspecified cyberattack. This publicly characterized the December outage as a security incident.
A vendor managing digital records for U.S. county governments reported unusual activity and temporarily took its servers offline. This marked the start of a disruption that affected customer access to records.
From December 15 onward, SecurityScorecard observed a large volume of flows between a vendor IP and DigitalOcean IP 174.138.64[.]88, all using port 22. The report assessed this activity may represent data exfiltration and noted consistency with BlackCat's ExMatter behavior.
A vendor IP sent a 12.28 MB transfer to 159.65.203[.]252, far larger than any other observed transfer involving that IP. SecurityScorecard noted that several vendors had linked the destination to malicious activity and assessed the traffic may reflect VPN use to obscure attacker origin.
A U.S. county government announced that a recent cyber incident had disrupted its online services. Subsequent reporting indicated the incident strongly resembled a ransomware attack.
Another county IP address transferred 327.68 KB to 139.59.130[.]20. SecurityScorecard assessed that traffic from county IPs to this host could indicate command-and-control communications or data exfiltration.
A county IP address transferred 360.45 KB to 139.59.130[.]20. Multiple vendors had linked that destination IP to malware or malicious activity, and VirusTotal community members had observed SSH brute-force behavior from it.
IP address 120.57.42[.]39 transferred 129 KB to a county IP address. The report notes that no vendors had linked this IP to malicious activity at the time.
SecurityScorecard observed that between July 12 and September 9 there were 935 netflow records involving transfers of one gigabyte or more to or from county IP addresses. The report says multiple counterpart IPs in these flows had prior malicious or suspicious associations.
SecurityScorecard observed IP address 142.93.204[.]250 transfer 352.26 KB to a county IP address. The source IP had prior links to SSH brute-force activity and Mirai-related Telnet targeting.
A second Cryxos-linked HTML file containing another county government URL appeared and referenced local church and county emergency services content. The report says this may indicate impersonation or compromise of a community-linked webpage used in targeting.
A malicious HTML/JavaScript file containing a county government URL appeared on VirusTotal and was detected by multiple vendors as a Cryxos variant. The file used a Weebly domain and county-themed lure content, suggesting search-engine-driven targeting tied to social engineering.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcesecurityscorecard.com
Open sourcecisa.gov
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026
Kaspersky detailed a BlackCat (`ALPHV`) ransomware intrusion in which attackers gained access with stolen credentials and moved laterally through the victim environment using common post-exploitation tooling, including **Impacket**. The operation followed a familiar double-extortion pattern: the intruders escalated privileges, conducted internal reconnaissance, staged data for exfiltration, and prepared systems for encryption before deploying the BlackCat payload. The incident showed how BlackCat affiliates combined legitimate remote administration activity with widely available offensive tools to blend into normal network traffic and accelerate compromise. The report highlights the group’s continued reliance on credential abuse, lateral movement over Windows administrative protocols, and data theft ahead of ransomware execution, underscoring the risk posed by affiliates that can rapidly turn an initial foothold into enterprise-wide disruption.
Jul 12, 2026