ALPHV/BlackCat (“BlackCat”, “Noberus”)

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Category: Cybercrime — Ransomware-as-a-Service (RaaS) / Multi-Extortion — Origin: Likely CIS / Russian-speaking ecosystem (public reporting)

Author: iQBlack CTI Team

Executive Summary

ALPHV/BlackCat is a financially motivated ransomware-as-a-service (RaaS) ecosystem active since at least late 2021, with core operators maintaining ransomware tooling and extortion infrastructure while affiliates conduct intrusions and deploy payloads. Public reporting consistently characterizes the operation as Russian-speaking and likely based in a Commonwealth of Independent States (CIS) country, with global victimization driven primarily by opportunity and exposure rather than strategic targeting.

The operation is notable for a Rust-based cross-platform ransomware family (Windows and Linux, including virtualization environments), a mature extortion workflow (data theft + encryption + leak-site pressure), and frequent use of “triple extortion” pressure levers such as threats of denial-of-service or outreach to third parties. In late 2023, U.S. authorities publicly described a disruption campaign that seized parts of ALPHV infrastructure and provided decryption capability to victims in some cases; incident reporting shows continued high-impact activity through early 2024, including healthcare sector disruption with broad downstream impact.

The ALPHV brand should be treated less as a single monolithic team and more as a marketplace and service layer: operator(s) provide ransomware, portals, and negotiation tooling; affiliates (with variable sophistication) source access through exploited edge services, stolen credentials, social engineering, and/or initial access broker markets. This operating model creates persistent risk even under partial law-enforcement disruption, because affiliates can churn, migrate, or rebrand while reusing tradecraft and tooling.