RANSOMWARE FAMILY
BlackCat / ALPHV
BlackCat, also known as ALPHV, is a ransomware-as-a-service operation written in Rust. It has been linked to a number of high-profile incidents and, like most modern groups, combines file encryption with data theft and leak-site extortion.
What to look for
- Encrypted files often given a random extension, varying by deployment
- A ransom note referencing "ALPHV" or "BlackCat" left in affected folders
- A leak site used to pressure victims with stolen data
- Attacks affecting a wide range of sectors, not any one industry
Recovery approach
Law enforcement action has disrupted this group's infrastructure more than once, but affiliates continue to operate — treat any related note as an active incident and contact us before doing anything else.
OTHER FAMILIES WE SEE
Also covered
Qilin
A ransomware-as-a-service group behind a number of significant UK healthcare and services incidents.
What to look for →RansomHub
A fast-growing ransomware-as-a-service operation that has absorbed affiliates from several disrupted groups.
What to look for →Play
Also known as PlayCrypt, a group that frequently exploits exposed VPN and remote-access systems.
What to look for →Medusa
A ransomware-as-a-service group operating a public leak site, frequently targeting healthcare and education.
What to look for →