Alphv / Blackcat

The operators of the ALPHV/BlackCat ransomware began their activity in December 2021, making posts on Dark Web forums to promote their affiliate program, offering other actors the opportunity to engage in a 'new type of ransomware family' developed from scratch using the Rust programming language.

Some clear evidence indicates that the actors behind this new ransomware are not new to cybercrime, and there were links to other affiliate programs such as DarkSide, BlackMatter, and REvil. (After several attacks against large companies, these groups faced pressure and arrests, necessitating the termination of their operations).

As a security measure, the operators of ALPHV implemented the requirement for the execution of the ransomware payload by providing an 'access token,' which is supplied by the owners of the Ransomware-as-a-Service to the affiliate. This token is added to the victim's ransom note so that they can contact the threat actor responsible for encrypting the data.

ALPHV affiliates employ double and triple extortion techniques, meaning the publication of the company's name on leak sites, threats of data leakage, and lastly, threats of DDoS attacks against the organization.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

731

First Discovered

2021-09-09

victim

Last Discovered

2024-03-03

victim

Inactive Since

2yrs

more than

Avg Delay

211.9

days

Infostealer

4.0%

victims with domain

View Victims on World Map

View group statistics

Known Locations (5)

Title	Available	Last Visit	FQDN
THIS WEBSITE HAS BEEN SEIZED	No	2025-06-01 21:18:20	`alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion`
THIS WEBSITE HAS BEEN SEIZED	No	2025-06-01 21:18:31	`alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion`
None	No	2025-06-01 21:18:36	`2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion`
	No	2025-06-01 21:19:27	`vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onion`
THIS WEBSITE HAS BEEN SEIZED	No	2025-06-01 21:19:35	`alphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (4)

Tools Used (Not Available)

Vulnerabilities Exploited (0)

TTPs Matrix (8)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Impact	Exfiltration
Valid Accounts	Native API	Valid Accounts	Access Token Manipulation: Create Process with Token	Obfuscated Files or Information	Credentials from Password Stores	Data Destruction	Exfiltration Over C2 Channel
External Remote Services	Scheduled Task/Job	Server Software Component	Abuse Elevation Control Mechanism: Bypass User Account Control	Impair Defenses: Disable or Modify Tools	Unsecured Credentials	Data Encrypted for Impact	Automated Exfiltration
Exploit Public-Facing Application	Command and Scripting Interpreter: Windows Command Shell		Valid Accounts	Indicator Removal: Clear Windows Event Logs	OS Credential Dumping: LSASS Memory	Service Stop	Data Transfer Size Limits
	Command and Scripting Interpreter: PowerShell			Deobfuscate/Decode Files or Information		Inhibit System Recovery	Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
	System Services: Service Execution			Virtualization/Sandbox Evasion		Network Denial of Service	Exfiltration Over Web Service: Exfiltration to Cloud Storage
	Windows Management Instrumentation			Masquerading
				Modify Registry

Negotiation Chats (0)

YARA Rules (2)

Indicators of Compromise (IoCs) (0)