BlackCatMalware
BlackCat (ALPHV) is ransomware written in Rust. The ransomware makes heavy use of plaintext JSON configuration files to specify the ransomware functionality. BlackCat has many advanced capabilities like escalating privileges and bypassing UAC make use of AES and ChaCha20 or Salsa encryption, may use the Restart Manager, can delete volume shadow copies, can enumerate disk volumes and network…From MISP Galaxy
Last reported 2 days ago, by Security Affairs35 reports
ATT&CK techniques
6 of 97 · each with the sentence it comes from- T1684Social Engineering
“…ckCat operates as a Ransomware-as-a-Service (RaaS) with affiliates adopting whatever intrusion techniques yield results, including social engineering and malvertising.”
- T1021.001Remote Desktop Protocol
“They also employ remote desktop protocol (RDP) to expand their presence within the compromised network.”
- T1490Inhibit System Recovery
“T1490 Inhibit System Recovery”
- T1053.005Scheduled Task
“The phishing emails are delivering malicious archive files that use virtual hard disks to create scheduled tasks that periodically run the group's malware.”
- T1110Brute Force
“…nitial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory.”
- T1014Rootkit
“SIXZUT and JITTERLY: Newly launched security firm VirLabs looks at SIXZUT and JITTERLY, a Linux implant and a rootkit that are being planted by the Red Heron group on Gitea servers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
35 reports · the newest 20, newest first · the exact sentence from each-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations“SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued.”
-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy“Researchers suggested that the action against the likes of Lockbit, BlackCat and RansomHub helped to reduce ransomware activity during 2025.”
-
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns“It is believed that SafePay may be a rebrand of several other well-known groups – LockBit, ALPHV/BlackCat and INC Ransomware.”
-
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site“According to the DOJ, Martino was paid by BlackCat attackers to provide confidential information about the negotiating position and strategy of his employer’s clients and enable the ransomware actors to maximize the ransoms paid by the victims.”
-
RMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)“…s continue to be identified; SimpleHelp has been used in attacks linked to the Play [5] ransomware, as well as in Medusa [6] and ALPHV (BlackCat) [7] ransomware attacks.”
-
Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia“RatHat evolution: Cleafy researchers have traced the new RatHat Android banking trojan to the old BlackCat to Panda Workshop strains, of which RatHat is a rebrand, although with a relatively new codebase.”
-
RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model“…hanged little from late 2025 through September 2026, while its C2 panel went through three generations in six months and rebranded from BlackCat to Panda Workshop.”
-
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims“The first calls itself BlackCat Remote Control Management.”
-
July 2026 Dark Web Threat Actor Trend Report“Arrest BD-Anonymous BlackCat Bolt BreachForums CoinbaseCartel DarkMatter DarkWeb data-breaches DDoS DeepWeb ExploitGym 딥웹 다크웹 Finance government Hacktivism Handala Healthcare HuggingFace IAB Indictment Kratos law-enforcement logistics Media Military ModernStealer OpenAI RaaS Reta…”
-
Ransomware in 2026: Same Business, New Rules“Just a few years ago, the ransomware conversation revolved around a handful of dominant franchises: LockBit, BlackCat, Cl0p.”
-
Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs“…ary 2023 attack on Riot Games, which involved ransom demands to prevent source code leakage, and more recent operations affiliated with BlackCat and DragonForce ransomware groups, including attacks on MGM and Caesars (2023) and Co-op and Marks & Spencer (2025).”
-
Holding blobs for ransom: Four methods for Azure Storage ransomware“In 2023, Sophos X-Ops reported the BlackCat ransomware gang deployed ransomware on victim Azure Storage accounts by encrypting their blobs with Sphynx encryptor.”
-
El back office del ransomware: la industria que la nota de rescate no muestra“En marzo de 2024, un afiliado de la banda del grupo ransomware BlackCat publicó una queja en un foro de ciberdelincuencia.”
-
Study of Binaries Created with Rust through Reverse Engineering“…ogramming language, malware developed using Rust (hereinafter referred to as "Rust malware"), such as Rust variants of SysJoker and the BlackCat ransomware, has also been increasing in recent years.”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“Part of the analyzed activity in the ShadowSyndicate cluster can be attributed to Cl0p, ALPHV/BlackCat, Black Basta, Ryuk, and Malsmoke.”
-
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware“Please note that the commands related to modification of symLink evaluation behavior are also present in the BlackCat and Cicada3301 ransomware.”
-
Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group“Interestingly, the Cicada3301 ransomware shares very strong similarities with the retired and infamous ransomware, BlackCat.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“ALPHV (aka BlackCat) is a ransomware operator group discovered in December 2021.”
-
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report“Most of the attacks were attributed to the groups Lockbit (18%), Conti (11%), and BlackCat (8%)”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
Copy this indicator · defanged
Thanks — we review every report.