alphv

· ActiveThe operators of the ALPHV/BlackCat ransomware began their activity in December 2021, making posts on Dark Web forums to promote their affiliate program, offering other actors the opportunity to engage in a 'new type of ransomware family' developed from scratch using the Rust programming language. Some clear evidence indicates that the actors behind this new ransomware are not new to cybercrime, and there were links to other affiliate programs such as DarkSide, BlackMatter, and REvil. (After several attacks against large companies, these groups faced pressure and arrests, necessitating the termination of their operations). As a security measure, the operators of ALPHV implemented the requirement for the execution of the ransomware payload by providing an 'access token,' which is supplied by the owners of the Ransomware-as-a-Service to the affiliate. This token is added to the victim's ransom note so that they can contact the threat actor responsible for encrypting the data. ALPHV affiliates employ double and triple extortion techniques, meaning the publication of the company's name on leak sites, threats of data leakage, and lastly, threats of DDoS attacks against the organization. Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

731

Status

Active

Sites

Countries Hit

Profile

[CISA Alert aa23-353a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a)

[IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment](https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/)

https://cloud.google.com/blog/topics/threat-intelligence/ransomware-attacks-surge-rely-on-public-legitimate-tools

https://news.sophos.com/en-us/2022/08/10/lockbit-hive-and-blackcat-attack-automotive-supplier-in-triple-ransomware-attack

Top Countries

US352

CA38

GB34

DE30

Unknown24

AU24

IT17

FR15

IN12

BR12

Top Sectors

Manufacturing108

Healthcare82

Business Services79

Technology60

Recent Victims

View all 731 →

ipmaltamira

MX · Business Services

Mar 3, 2024

Ewig Usa

CN · Manufacturing

Mar 3, 2024

SBM & Co

GB · Business Services

Mar 1, 2024

Petrus Resources Ltd

US · Energy

Mar 1, 2024

Kumagai Gumi Group

JP · Business Services

Mar 1, 2024

Allan Berger & Associates

US · Business Services

Feb 29, 2024

Change Healthcare - Optum - UnitedHealth

US · Healthcare