alphv

ALPHV, also known as BlackCat, is a highly sophisticated ransomware-as-a-service operation that emerged in November 2021 and quickly became one of the most prolific ransomware groups, primarily motivated by financial gain. The group is suspected to have ties to former DarkSide and BlackMatter affiliates and operates as a RaaS model, recruiting experienced affiliates from other disbanded ransomware operations. ALPHV employs multiple initial access vectors including exploitation of unpatched vulnerabilities, credential stuffing attacks, and compromised Remote Desktop Protocol connections, utilizing a Rust-based ransomware payload that enables cross-platform encryption across Windows, Linux, and VMware ESXi systems, while consistently employing double extortion tactics by exfiltrating sensitive data before encryption and threatening public release on their leak site. The group has conducted several high-profile attacks including the December 2021 compromise of oil and gas company Swissport, attacks against multiple healthcare systems, and notably demanded a record-breaking $80 million ransom from software company Medibank in October 2022, with the FBI issuing multiple advisories warning of their targeting of critical infrastructure sectors. Despite ongoing law enforcement efforts and sanctions, ALPHV remains active as of late 2023, continuing to recruit new affiliates and launch attacks against organizations primarily in the United States, Canada, Australia, United Kingdom, and Germany, with particular focus on business services, healthcare, energy, technology, and manufacturing sectors.