ALPHV, also known as BlackCat, is a highly sophisticated ransomware-as-a-service operation that emerged in November 2021 and quickly became one of the most prolific ransomware groups, primarily motivated by financial gain. The group is suspected to have ties to former DarkSide and BlackMatter affiliates and operates as a RaaS model, recruiting experienced affiliates from other disbanded ransomware operations. ALPHV employs multiple initial access vectors including exploitation of unpatched vulnerabilities, credential stuffing attacks, and compromised Remote Desktop Protocol connections, utilizing a Rust-based ransomware payload that enables cross-platform encryption across Windows, Linux, and VMware ESXi systems, while consistently employing double extortion tactics by exfiltrating sensitive data before encryption and threatening public release on their leak site. The group has conducted several high-profile attacks including the December 2021 compromise of oil and gas company Swissport, attacks against multiple healthcare systems, and notably demanded a record-breaking $80 million ransom from software company Medibank in October 2022, with the FBI issuing multiple advisories warning of their targeting of critical infrastructure sectors. Despite ongoing law enforcement efforts and sanctions, ALPHV remains active as of late 2023, continuing to recruit new affiliates and launch attacks against organizations primarily in the United States, Canada, Australia, United Kingdom, and Germany, with particular focus on business services, healthcare, energy, technology, and manufacturing sectors. The group has been linked to 731 public disclosures across our corpus. First observed on a leak site on September 9, 2021; most recent post March 3, 2024. The operation is currently inactive.
Also tracked as: BlackCat, Noberus.
Sector and geography
This disclosure adds to ransomware activity in the Not Found sector, which has 4,859 disclosures indexed across all operators we track. Geographically, ANDFLA SRL is reported in RO, a country with 10 ransomware disclosures in our corpus.
How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.
