ALPHV

The operators of the ALPHV/BlackCat ransomware began their activity in December 2021, making posts on Dark Web forums to promote their affiliate program, offering other actors the opportunity to engage in a 'new type of ransomware family' developed from scratch using the Rust programming language. Some clear evidence indicates that the actors behind this new ransomware are not new to cybercrime, and there were links to other affiliate programs such as DarkSide, BlackMatter, and REvil. (After several attacks against large companies, these groups faced pressure and arrests, necessitating the termination of their operations). As a security measure, the operators of ALPHV implemented the requirement for the execution of the ransomware payload by providing an 'access token,' which is supplied by the owners of the Ransomware-as-a-Service to the affiliate. This token is added to the victim's ransom note so that they can contact the threat actor responsible for encrypting the data. ALPHV affiliates employ double and triple extortion techniques, meaning the publication of the company's name on leak sites, threats of data leakage, and lastly, threats of DDoS attacks against the organization.

It posted no listings in the last 12 months.

The group is associated with 1 malware families.

Also known as: blackcat

Most targeted country: United States, with 92 listings (13% of the total).

Most targeted sector: Professional Services, with 171 listings (23% of the total).

Targeted countries

Targeted sectors

Showing 10 of 731 results

34 MITRE ATT&CK techniques across 8 stages are documented in the group's attacks.

1
Initial access
The attacker gets into the corporate network for the first time.
T1078Valid AccountsT1133External Remote ServicesT1190Exploit Public-Facing Application
2
Execution
Malicious code runs on the target system.
T1053Scheduled Task/JobT1059.001Command and Scripting Interpreter: PowerShellT1059.003Command and Scripting Interpreter: Windows Command ShellT1072Windows Management InstrumentationT1106Native APIT1569.002System Services: Service Execution
3
Persistence
Access survives reboots and password changes.
T1078Valid AccountsT1547Server Software Component
4
Privilege escalation
The attacker moves to accounts with higher privileges.
T1078Valid AccountsT1134.002Access Token Manipulation: Create Process with TokenT1548.002Abuse Elevation Control Mechanism: Bypass User Account Control
5
Defense evasion
Security software and logging are bypassed.
T1027Obfuscated Files or InformationT1036MasqueradingT1070.001Indicator Removal: Clear Windows Event LogsT1112Modify RegistryT1140Deobfuscate/Decode Files or InformationT1497Virtualization/Sandbox EvasionT1562.001Impair Defenses: Disable or Modify Tools
6
Credential access
Passwords, tokens and session data are stolen.
T1003.001OS Credential Dumping: LSASS MemoryT1552Unsecured CredentialsT1555Credentials from Password Stores
7
Exfiltration
Data is moved out of the organization; the threat to publish it in the listing relies on this data.
T1020Automated ExfiltrationT1030Data Transfer Size LimitsT1041Exfiltration Over C2 ChannelT1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
8
Impact
Systems are encrypted or services are stopped.
T1485Data DestructionT1486Data Encrypted for ImpactT1489Service StopT1490Inhibit System RecoveryT1498Network Denial of Service

The group is associated with 1 malware families.

Malware families

BlackCat

Published reports on this actor:

https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/

Source: MISP Galaxy, Malpedia.

What does a ransomware group do?

Ransomware groups break into corporate networks, move data out and encrypt systems. If the ransom is not paid, they list the organization on a leak site and threaten to publish the data.

How does ALPHV get into organizations?

The attacker gets into the corporate network for the first time.

T1078 · Valid Accounts
T1133 · External Remote Services
T1190 · Exploit Public-Facing Application

Which defenses matter most?

Priority defenses based on the documented techniques:

Keep internet-facing VPN, remote desktop and firewall interfaces patched, and require multi-factor authentication on these accounts.
Allow scripts and macros only for users who need them, and keep behavioral rules enabled in endpoint protection.
Monitor newly created services, scheduled tasks and startup entries.
Reduce local administrator accounts and perform privileged tasks from separate, monitored accounts.
Alert when security software is disabled or logs are cleared.
Regularly check whether employee passwords and session cookies appear in infostealer logs.
Monitor unusual data volumes sent to cloud storage and file transfer services.
Keep offline, immutable backups and test restores regularly.

What should you do if your organization is listed on a leak site?

Record the listing and any published sample files; do not visit the leak site from the corporate network.
Isolate affected systems and preserve logs without deleting them.
Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
Make any decision about the ransom demand together with legal, management and incident response.
Do not bring systems back online before the attacker’s entry point is closed.

Is your organization mentioned?

Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.

Search your domain

Listings per month

Targeted countries

Targeted sectors

Initial access

Execution

Persistence

Privilege escalation

Defense evasion

Credential access

Exfiltration

Impact

Malware families

Intelligence 360