Log in Request a demo

Ransomware group profile

ALPHV / BlackCat

Also known as ALPHV, BlackCat, Noberus

ALPHV Blackcat is a ransomware as a service operation.

  • Disrupted

In short

ALPHV Blackcat is a ransomware as a service operation. The FBI, CISA and the US Department of Health and Human Services describe it in a joint advisory (AA23-353A, first issued December 19, 2023, revised 27 February 2024). Operators run the ransomware and affiliates carry out the attacks.

Profile MapRansomware Group
  1. StatusDisruptedas reported
  2. Other Names3names in public reportsALPHV · BlackCat · Noberus
  3. Entry Routes4ways inStolen or compromised accounts
  4. Defences6first steps listedPhishing-resistant MFA · Control remote access tools

Overview

ALPHV Blackcat, also called BlackCat or Noberus, is a ransomware as a service (RaaS) operation. In this model a core team builds the ransomware and runs the payment and leak sites. Independent partners, called affiliates, break into victims and use the tool. MITRE ATT&CK describes BlackCat as ransomware written in Rust, first observed in November 2021.

Who and when

The FBI, CISA and the US Department of Health and Human Services (HHS) published advisory AA23-353A on December 19, 2023, and updated it on February 27, 2024. It builds on an FBI alert from April 19, 2022. The advisory says affiliates have extensive networks and experience with ransomware and data extortion.

ALPHV Blackcat timeline
  1. November 2021First observedMITRE ATT&CK records BlackCat as first observed in November 2021.
  2. April 19, 2022FBI alertThe FBI published its first alert on BlackCat/ALPHV indicators of compromise.
  3. February 2023Sphynx updateAdministrators announced the 2.0 Sphynx rewrite, with better defense evasion and extra tooling.
  4. Early December 2023Operational actionThe advisory refers to operational action against the group and its infrastructure.
  5. December 19, 2023Joint advisoryThe FBI, CISA and HHS issued AA23-353A.
  6. Mid-December 2023Hospitals targetedThe advisory says healthcare became the most commonly victimized sector in the weeks that followed.
  7. February 27, 2024Advisory updateThe advisory was updated with new indicators and tactics.

What makes it distinct

The February 2023 Sphynx update added features for affiliates and can encrypt Windows and Linux devices as well as VMware instances. The advisory also stresses social engineering. Affiliates phone or text employees while posing as IT or help desk staff to get passwords. They also use an open source tool that steals login details, multifactor authentication (MFA) codes and session cookies.

After entry, affiliates install remote access tools, collect data and copy it out to cloud storage. They then deploy the ransomware. Some offer victims a “vulnerability report” after payment, presented as security advice.

Law-enforcement action and aftermath

The February 2024 update says that after operational action against the group and its infrastructure in early December 2023, the administrator posted encouraging affiliates to target hospitals. In the advisory’s words, of nearly 70 leaked victims since mid-December 2023, healthcare was the most common sector. The advisory calls this likely a response to that action. We could not open the US Department of Justice release on the disruption, so details of the action are not given here.

At a glance
Also known as
ALPHV, BlackCat, Noberus
Model
Ransomware as a service
First observed
November 2021 (MITRE ATT&CK)
Main advisory
AA23-353A, December 19, 2023, revised 27 February 2024
Written in
Rust (MITRE ATT&CK)
Systems hit
Windows, Linux, VMware

Also known as

  • ALPHV
  • BlackCat
  • Noberus

How they get in

  1. 01

    Phone and SMS social engineering

    Affiliates pose as company IT or help desk staff and call or text employees to obtain credentials, using open source research on the company first.

  2. 02

    Stolen or compromised accounts

    The advisory says affiliates use compromised accounts to gain access to victim networks, and obtain passwords from domain controllers, local networks and deleted backup servers to move sideways.

  3. 03

    Adversary in the middle phishing

    Affiliates use an open source framework to capture MFA credentials, login credentials and session cookies, which defeats basic MFA.

  4. 04

    Remote access tools after entry

    Once inside, they install remote access software and tunneling tools to keep control and prepare data theft.

How they extort

Per the FBI, CISA and HHS: affiliates steal data, may or may not encrypt, and then contact victims through Tor, Tox, email or encrypted apps. Some affiliates extort victims without deploying ransomware at all. Victim-specific emails have been used to announce a compromise.

Who they target

  1. 01

    Healthcare

    See the industry page
  2. 02

    Critical infrastructure organizations (all sectors)

How to defend

  1. Phishing-resistant MFA

    Use FIDO/WebAuthn or PKI-based MFA. The advisory says these resist push bombing and SIM swap attacks that affiliates use.

  2. Control remote access tools

    Allowlist approved remote access programs and block portable, unapproved ones. Follow CISA's guide to securing remote access software.

  3. Watch the network

    Log and report network traffic, and use endpoint detection and response (EDR) to spot lateral movement.

  4. Train staff on social engineering

    Teach staff to spot fake help desk calls, texts and suspicious email, and to report them.

  5. Monitor internal mail and messaging

    Set a baseline of normal traffic and look into deviations, because users may be phished from outside your network.

  6. Patch known exploited flaws and close unused ports

    The advisory lists patching known exploited vulnerabilities, enforcing MFA and removing unneeded applications as actions to take today.

Questions

What is ALPHV / BlackCat ransomware?

ALPHV Blackcat, also called BlackCat or Noberus, is a ransomware as a service operation. A core team builds the ransomware and runs the payment and leak sites, while affiliates break into victims. MITRE ATT&CK records it as written in Rust and first observed in November 2021.

How do ALPHV affiliates get in?

Advisory AA23-353A stresses social engineering. Affiliates phone or text employees posing as IT or help desk staff to get passwords. They also use compromised accounts and an open source tool that steals login details, MFA codes and session cookies.

What happened to ALPHV in December 2023?

The advisory refers to operational action against the group and its infrastructure in early December 2023. Afterwards the administrator posted encouraging affiliates to target hospitals, and healthcare was the most common sector among nearly 70 leaked victims.

How can I defend against ALPHV / BlackCat?

The advisory points to phishing-resistant MFA, controlling remote access tools, network logging with EDR, staff training on fake help desk calls, and patching known exploited flaws. It says FIDO or PKI-based MFA resists push bombing and SIM swap attacks.

In our research

  1. FIN8 Group Uses Sardonic Backdoor for BlackCat Ransomware Attacks July 2023
  2. BlackCat Ransomware Is Targeted Vulnerable Microsoft Exchange Servers June 2022
  3. Why Ransomware Fragmentation Makes Attribution Harder Than Ever August 2026
  4. Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
  5. Ransomware in U.S. Healthcare: Threat Landscape, Impact, and Mitigation Strategies May 2026
  6. Scattered Spider: An Emerging Cybercriminal Collective November 2025

Sources

  1. #StopRansomware: ALPHV Blackcat (AA23-353A) CISA, FBI, HHS
  2. BlackCat, Software S1068 MITRE ATT&CK

Last updated 9 October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Scattered Spider

Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large companies and their IT help desks, mainly by tricking staff into resetting passwords and MFA. The UK National Crime Agency said on 16 July 2026 that its action against two leading members effectively halted the group, while others may reuse the name.

Read more

Glossary term

Ransomware-as-a-service (RaaS)

Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims.

Read more