BlackCat, also called ALPHV, is a Rust-based ransomware-as-a-service that has operated since November 2021. Its common scams steal logins to encrypt systems and extort payment, while follow-up threats add data leaks, harassment, and re-extortion even after payment. Affiliates rent the malware, break into Windows, Linux and VMware ESXi systems, steal data, then encrypt files for double extortion. Victims face leak-site threats first, then more direct pressure if they do not pay quickly.
Table of Contents
- How does BlackCat break in?
- What happens after files are encrypted?
- What extra pressure tactics follow?
- Why does paying not end the risk?
- What should victims and staff do?
How does BlackCat break in?
Affiliates often start with stolen credentials and careful research on staff and IT procedures. According to the CISA, FBI and HHS joint advisory, they pose as IT or helpdesk staff by phone or SMS and use Evilginx2 to steal logins, multi-factor codes and session cookies.
That access lets them bypass normal login checks without brute force. Palo Alto Networks Unit 42 describes the operation in its threat assessment of BlackCat ransomware as a Rust-based service hitting Windows, Linux and ESXi after data theft.
- Treat unexpected IT calls or password-reset texts as suspect, especially urgent ones.
- Check the caller through a known internal number, not a number they provide.
- Report unfamiliar multi-factor prompts and session-expired logouts to security staff.
What happens after files are encrypted?
Encryption stops normal work, but theft matters as much as locking files. Operators keep copies of sensitive data and threaten to publish them on a leak site if the ransom is not paid.
Akamai reports that BlackCat then uses triple extortion when needed. After encryption and leak threats, operators threaten distributed denial-of-service attacks and send victim-specific emails and live-chat links to force talks.
What extra pressure tactics follow?
Pressure is personal and public. In November 2023, BlackCat filed a Securities and Exchange Commission tips complaint against MeridianLink for not disclosing its breach, then posted the receipt on its leak site. BankInfoSecurity called it a first-of-its-kind regulatory-pressure tactic.
Law enforcement has answered with disruption. The Justice Department said its Dec. 19, 2023 seizure of ALPHV sites, described in its update on the prior disruption, included a decryption tool that helped about 500 victims restore systems and avoid about $99 million in ransoms.
Why does paying not end the risk?
The Change Healthcare attack shows the limit of payment. An affiliate struck around Feb. 21, 2024, about $22 million in Bitcoin was paid, then ALPHV administrators kept the money, cut off the affiliate and shut down infrastructure in an exit scam, as summarized by Infosecurity Magazine in its report on the gang shutting servers.
The unpaid affiliate still held stolen data. That data reappeared for re-extortion on RansomHub in April 2024, according to a Paubox group profile, proving payment did not ensure deletion. Healthcare Dive and federal records place the affected population at 100 million in October 2024, later rising to about 190-192.7 million, with UnitedHealth reporting over $2.9 billion in costs and nationwide pharmacy-care disruption.
What should victims and staff do?
Assume stolen data may return elsewhere, even if one demand is met. Preserve logs, ransom notes, chat URLs and email headers, isolate affected systems, and seek incident-response and legal help before contacting the criminals.
- Do not delete evidence or restart encrypted servers repeatedly.
- Do not assume payment buys deletion; plan for notification and monitoring.
- Warn staff about follow-up emails, chats and fake helpdesk calls using breach details.
You Might Also Like
- Rhysida Ransomware: Common Scams and Follow-Up Threats
- Play Ransomware: What Organizations Should Fix Next
- Ransomware as a Service for Consumers: Warning Signs and Protective Steps