Announcementseverity: High2023-12-19
FBI-led international operation seizes ALPHV infrastructure and releases decryptor
published by Krebs on Security
Actor
Russian-speaking ransomware-as-a-service operation, first observed November 2021, notable as the first prominent ransomware family written in Rust. Operated the affiliate program responsible for the…
Summary
U.S. and partner agencies (UK NCA, Europol, Germany, Denmark, Spain, Australia) executed a coordinated disruption of ALPHV BlackCat, seizing several Tor sites and releasing a decryptor developed with the help of a confidential source who provided access to the affiliate panel. The FBI said the tool had already helped roughly 500 victims avoid an estimated $68 million in ransom demands.
Tags
law-enforcementtakedowndecryptor
Primary source
krebsonsecurity.comOther ALPHV/BlackCat events
- 2025-11-19Two U.S. cybersecurity workers plead guilty to ALPHV BlackCat affiliate scheme
- 2024-03-05ALPHV BlackCat shuts down in apparent exit scam after Change Healthcare payment
- 2024-02-21Change Healthcare ransomware incident attributed to ALPHV BlackCat
- 2023-12-19Joint CISA/FBI/HHS advisory AA23-353A on ALPHV BlackCat
- 2021-11-01ALPHV/BlackCat Rust-based RaaS first observed