What is ALPHV, also called BlackCat?

ALPHV, also known as BlackCat, was a ransomware-as-a-service operation active from late 2021, notable for being written in the Rust programming language and for encrypting both ordinary servers and virtualisation hosts. CISA and the FBI described it in advisory AA23-353A, first published on 19 December 2023 and updated in February 2024: by then its affiliates had compromised over 1,000 entities worldwide, often after tricking help desks and IT staff into handing over credentials. In December 2023 the FBI announced that it had disrupted the group and given a decryption tool to more than 500 victims. ALPHV resumed briefly and then shut down in March 2024, in what many researchers described as an exit scam on its own affiliates. The affiliates did not disappear; many moved to other platforms. The advisory's key lesson for small companies: train help-desk staff to verify identity before any password or MFA reset.

← All 25 questions on Ransomware groups and familiesAll topics