BLACKCAT / ALPHV

BlackCat — publicly better known as ALPHV, and tracked in its malware form by MITRE ATT&CK as Noberus (Software S1068) — was, at its peak, the most prolific ransomware-as-a-service operation in the world. Emerging in November 2021 as the first major RaaS family written in Rust, it compromised more than 1,000 organizations worldwide (roughly 75% in the United States), demanded over $500 million in ransom, and collected an estimated $300 million before a coordinated international law-enforcement operation disrupted its infrastructure in December 2023. It is the third documented generation of a single lineage that began with DarkSide: DarkSide's 2021 collapse produced BlackMatter, and BlackMatter's 2021 collapse — corroborated by an April 2022 FBI advisory naming shared developers and money launderers — produced BlackCat/ALPHV (see this repository's companion card: output/actors/2026-09-12_DARKSIDE.html).

BlackCat matters for reasons that go beyond scale. Technically, it was genuinely more capable than its predecessors: a single Rust codebase compiled cleanly across Windows, Linux, and VMware ESXi; a February 2023 "Sphynx" rewrite that embedded legitimate remote-execution tooling (Impacket, RemCom) directly into the payload and reworked its command-line signature specifically to defeat existing detections; and a documented practice, alongside its most capable affiliates, of using malicious signed kernel drivers to forcibly kill endpoint security software before deploying ransomware. Operationally, it attracted — and was, in turn, made devastating by — some of the most capable criminal affiliates in the ecosystem, most notably Scattered Spider (tracked elsewhere as UNC3944/Octo Tempest/0ktapus; see this repository's companion card: output/actors/2026-08-30_SCATTERED-SPIDER.html), whose September 2023 social-engineering intrusions into MGM Resorts and Caesars Entertainment, both deploying BlackCat/ALPHV ransomware, became two of the most closely studied ransomware incidents of the decade.

BlackCat's end was as instructive as its operation. After the FBI's December 2023 disruption — which the group publicly, and accurately, undermined within days by retaining control of its own leak-site signing keys — BlackCat's operators went on to orchestrate what independent researchers assess as a deliberate exit scam: extracting an alleged $22 million ransom from the February 2024 Change Healthcare attack (one of the most disruptive single cyberattacks on U.S. healthcare billing infrastructure in history) and then staging a fake law-enforcement seizure notice to disappear with the funds rather than pay their own affiliate. The group has been inactive since March 2024, but its affiliates did not retire — they are assessed to have substantially migrated to RansomHub and, per infrastructure and code overlap, to Embargo, meaning the operational risk BlackCat represented has not disappeared so much as changed its letterhead once again.

Entry vectors. BlackCat's affiliate base used a wider and more opportunistic range of initial-access techniques than its DarkSide-lineage predecessor. Documented vectors include exploitation of public-facing enterprise software vulnerabilities — Veritas Backup Exec (CVE-2021-27876/-27877/-27878, per Mandiant's UNC4466 tracking), Fortra GoAnywhere MFT (CVE-2023-0669), and, most consequentially, ConnectWise ScreenConnect (CVE-2024-1709/-1708) in the Change Healthcare attack — alongside stolen or IAB-purchased VPN/RDP credentials, and, in the group's most damaging documented intrusions, sophisticated social engineering: Scattered Spider's helpdesk-impersonation vishing calls, which secured full administrative access to MGM Resorts' Okta and Azure environments in a single ten-minute phone call.

Toolchain and internal operations. Once inside, BlackCat affiliates favor a mix of native Windows tooling and a small set of dual-use utilities embedded directly into later payload builds. The February 2023 "Sphynx" rewrite bundled Impacket (for remote service manipulation and lateral movement) and RemCom (a PsExec-style remote command-execution tool) into the ransomware build itself, reducing the affiliate's need to stage separate tooling. Malicious Group Policy Objects, deployed via Windows Task Scheduler, and a sequence of staging batch/PowerShell scripts (publicly documented as start.bat, est.bat, and run.bat) orchestrate credential harvesting from local password stores, network discovery, and eventual payload execution across compromised hosts.

Defense evasion, exfiltration, and impact. Before deploying the ransomware payload, BlackCat-affiliated intrusions are documented using Bring-Your-Own-Vulnerable-Driver (BYOVD) techniques — most notably the POORTRY/STONESTOP malicious signed-driver loader (also associated with Scattered Spider/UNC3944 activity) and separately the commercial "Terminator" tool from the SpyBoy marketplace — to forcibly disable endpoint security agents before encryption begins. Data exfiltration for the group's double/triple-extortion model runs primarily through ExMatter, a purpose-built .NET exfiltration tool. Immediately pre-encryption, the toolkit clears Windows Event Logs (documented via wevtutil.exe el to enumerate available logs, followed by wevtutil.exe cl against each) and deletes Volume Shadow Copies via vssadmin and wmic, disabling Windows automatic repair. The Rust-based payload itself then encrypts the environment — Windows, Linux, and ESXi hosts alike — using a configurable ChaCha20 or AES scheme wrapped in an RSA key-encapsulation layer, before the victim receives a ransom note directing them to a Tor negotiation portal under the threat of encryption, public data leak, and (per the group's own "triple extortion" branding) a DDoS attack against public-facing infrastructure if demands are not met.

BlackCat represents the maturation point of the DarkSide-originated RaaS lineage: technically more capable than either predecessor, and — critically — willing to recruit and retain affiliates capable of far more sophisticated intrusions than credential-stuffing or opportunistic vulnerability scanning. The MGM Resorts and Caesars Entertainment attacks are the clearest evidence for this analyst's judgment that BlackCat's core danger was never purely technical: Scattered Spider's ten-minute vishing call succeeded against defenses that would likely have stopped a scripted, low-skill intrusion attempt. Any organization assessing BlackCat-lineage risk should weight identity-verification and help-desk social-engineering resilience at least as heavily as technical patching and EDR deployment — this group's most damaging incidents were won on the phone, not in the code.

The March 2024 collapse leaves a genuinely open analytical question this assessment does not resolve: whether BlackCat's operators executed a purely opportunistic exit scam against one affiliate (Change Healthcare's $22M payment), or whether the entire episode — Change Healthcare, the theft from "Notchy," and the fabricated seizure notice — was a calculated exfiltration of the group's own remaining value ahead of an anticipated second, more damaging law-enforcement action following the December 2023 disruption. The DigitalMint/Sygnia insider-affiliate indictments (incident-response professionals who became ransomware operators against the very type of company they were paid to defend) further complicate the picture of who, precisely, "BlackCat" was by the time of its collapse — the RaaS model's separation of core developers from affiliates means the individuals actually facing prosecution are not necessarily representative of, or even known to, the group's founding operators.

Forward risk trajectory: treat RansomHub and Embargo as the operationally relevant continuation of this threat, not as unrelated new entrants — both inherited meaningful fractions of BlackCat's affiliate base and, in Embargo's case, apparent code/infrastructure lineage. Organizations should expect BlackCat-signature tradecraft (Rust-based cross-platform payloads, BYOVD EDR killing, ScreenConnect/remote-support-software exploitation, and vishing-based help-desk social engineering) to persist under these or future successor brand names, consistent with the pattern already established twice over in this lineage's history.