ALPHV/BlackCat
Russian-speaking ransomware-as-a-service operation, first observed November 2021, notable as the first prominent ransomware family written in Rust. Operated the affiliate program responsible for the February 2024 attack on Change Healthcare (UnitedHealth subsidiary) which disrupted U.S. pharmacy claims processing for weeks. The operation ran an exit-scam in early March 2024 after the Change Healthcare ransom was paid, stiffing its own affiliate.
Aliases
Motivations
Target sectors
Target countries
Lineage & relationships
full graph →Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Tools & malware
1 entryTimeline
6 events- IndictmentHigh2025-11-19·U.S. Department of Justice
Two U.S. cybersecurity workers plead guilty to ALPHV BlackCat affiliate scheme
DOJ announced that Ryan Goldberg and Kevin Martin pleaded guilty in the Southern District of Florida to conspiring to commit Hobbs Act extortion via ALPHV BlackCat attacks on U.S. victims between April and December 2023. The defendants, both employed in the cybersecurity industry, agreed to pay BlackCat operators a 20% share of ransoms and successfully extorted one victim of approximately $1.2 million in Bitcoin.
dojguilty-pleaaffiliateextortion - AnnouncementHigh2024-03-05·BleepingComputer
ALPHV BlackCat shuts down in apparent exit scam after Change Healthcare payment
The ALPHV BlackCat operators took their Tor leak site offline on 1 March 2024 and on 5 March announced the operation's closure, posting a fabricated FBI seizure banner that the UK NCA publicly denied. The operators offered the ransomware source code for $5 million and stiffed the affiliate behind the Change Healthcare intrusion, who retained roughly 4 TB of stolen data.
exit-scamraasinfrastructure - CompromiseCritical2024-02-21·Krebs on Security
Change Healthcare ransomware incident attributed to ALPHV BlackCat
UnitedHealth Group's Change Healthcare subsidiary was crippled by ALPHV BlackCat ransomware after the actors used credentials on a remote-access portal lacking multi-factor authentication. The incident disrupted U.S. healthcare claims and pharmacy processing for weeks and ultimately involved a roughly $22 million ransom payment that the operators kept rather than sharing with the affiliate who conducted the intrusion.
healthcaresupply-chainextortionmfa - AnnouncementHigh2023-12-19·Krebs on Security
FBI-led international operation seizes ALPHV infrastructure and releases decryptor
U.S. and partner agencies (UK NCA, Europol, Germany, Denmark, Spain, Australia) executed a coordinated disruption of ALPHV BlackCat, seizing several Tor sites and releasing a decryptor developed with the help of a confidential source who provided access to the affiliate panel. The FBI said the tool had already helped roughly 500 victims avoid an estimated $68 million in ransom demands.
law-enforcementtakedowndecryptor - AdvisoryHigh2023-12-19·CISA
Joint CISA/FBI/HHS advisory AA23-353A on ALPHV BlackCat
FBI, CISA, and HHS released joint Cybersecurity Advisory AA23-353A detailing TTPs and IOCs for the ALPHV BlackCat RaaS, including the February 2023 'Sphynx' 2.0 rewrite that added Linux and VMware ESXi targeting. The advisory was updated on 27 February 2024 to note that, after early-December 2023 law enforcement action, the administrator urged affiliates to target the healthcare sector.
advisoryransomwarehealthcareesxi - ReportMedium2021-11-01·MITRE ATT&CK
ALPHV/BlackCat Rust-based RaaS first observed
MITRE ATT&CK records the BlackCat (a.k.a. ALPHV, Noberus) ransomware-as-a-service as first observed in November 2021. Written in Rust, it was among the first cross-platform ransomware families to ship native Windows, Linux, and ESXi builds, and is linked by researchers to the BlackMatter / DarkSide lineage.
ransomwareraasrustemergence
Indicators of compromise
3 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| SHA-256 | family · ALPHV/BlackCat SHA-256 of an ALPHV BlackCat Windows encryptor sample listed in CISA/FBI/HHS joint advisory AA23-353A (Table 2). | Dec 18, 2023 | CISA |
| SHA-256 | family · ALPHV/BlackCat SHA-256 of an ALPHV BlackCat Linux encryptor sample listed in CISA/FBI/HHS joint advisory AA23-353A (Table 2). | Dec 18, 2023 | CISA |
| Domain | family · ALPHV/BlackCat Command-and-control domain used by ALPHV BlackCat affiliates, published in the Network Indicators table of CISA/FBI/HHS advisory AA23-353A. | Dec 18, 2023 | CISA |
Related actors
shared ATT&CK techniques- RU · RussiaDarkSide4 shared techniques
- RU · RussiaINC Ransom4 shared techniques
- RU · Russia8Base3 shared techniques
- ?? · UnknownAkira3 shared techniques
- RU · RussiaConti3 shared techniques
- ?? · UnknownHive3 shared techniques
References
cite this page
Threat Intel Tracker. (2026-05-19). ALPHV/BlackCat — actor profile. Retrieved from https://threatintel.local/actors/alphv-blackcat