BlackCat ransomware (also known as Noberus or ALPHV)

BlackCat, also known as ALPHV and Noberus, was a ransomware-as-a-service (RaaS) operation active from late 2021 until early 2024. The operation is no longer running. US authorities disrupted its infrastructure in December 2023, and its operators shut the service down in March 2024 after taking a ransom payment owed to one of their own affiliates and staging a fake law enforcement seizure notice. While it was active, BlackCat was one of the most damaging ransomware operations of its period. Its affiliates stole data before encrypting systems, targeted Windows and Linux environments, and reached virtualization hosts. The operation was also among the first major ransomware families written in Rust, a choice that supported cross-platform development. BlackCat remains relevant because ransomware brands are temporary arrangements. The people who operated and used the service did not disappear when the brand ended. Affiliates moved to other operations with their access methods and techniques intact. Understanding BlackCat is therefore useful for studying how ransomware operations form, scale, disappear, and transfer capability to the next brand.

Key takeaways

BlackCat is no longer operating. Law enforcement disrupted its infrastructure in December 2023, and the operators shut the service down in March 2024.
It ended in an exit scam. The operators kept a ransom payment owed to an affiliate and posted a fabricated law enforcement seizure notice to cover their departure.
It was written in Rust. This supported versions for Windows and Linux, including virtualization hosts, and made the code less familiar to analysts at the time.
It relied on affiliates. The people conducting the intrusions moved to other ransomware operations after the service closed.
Its techniques still matter. Credential abuse, exposed remote access, help-desk social engineering, data theft, and encryption of virtualization hosts remain relevant beyond the BlackCat name.

Where BlackCat came from and how it ended

BlackCat appeared in December 2021, recruiting affiliates on criminal forums shortly after two earlier ransomware operations closed. Researchers assessed that experienced operators had regrouped under a new name, a recurring pattern in the ransomware ecosystem. Over the following two years, affiliates compromised organizations in sectors including healthcare, energy, manufacturing, and government.

In December 2023, US authorities disrupted the operation's infrastructure and released a decryption tool. According to the Department of Justice, the tool allowed affected organizations to recover without paying ransom demands totaling approximately $99 million. The operation was damaged but continued compromising organizations through January and February 2024.

In March 2024, the operation ended through an exit scam. After a healthcare technology company paid a ransom of approximately $22 million, an affiliate publicly complained that the operators had kept the payment instead of distributing the agreed share. The negotiation and leak infrastructure went offline within days, and a banner appeared on the operation's site claiming a coordinated law enforcement seizure.

The seizure notice was fabricated. Europol and the UK's National Crime Agency, both named on the banner, publicly confirmed that they had not been involved in a recent action. The operators announced that they were closing the project and offered the malware's source code for sale. Subsequent analysis concluded that the service had shut down.

Public reporting since then has not established that the original BlackCat service resumed. Prosecutions connected to its earlier activity may continue, but that is separate from the operation's status as an active ransomware service.

What made BlackCat notable

Four characteristics explain why BlackCat attracted attention while it was active and why security teams still study it.

Rust: BlackCat was among the first significant ransomware families written in Rust. The language supported builds for different operating systems and made the code less familiar to analysts than ransomware written in more established languages at the time.
Cross-platform reach into virtualization: Versions targeting Linux and VMware ESXi environments meant that one successful intrusion could affect many systems through a hypervisor host.
A large affiliate share: Affiliates were reportedly offered up to 80% or 90% of ransom proceeds, well above the market rate described at the time. The arrangement attracted capable operators and supported a high volume of attacks.
Aggressive extortion: The operation stole data before encryption and used a publicly searchable leak site, making stolen information easier for customers, partners, and journalists to find.

How BlackCat attacks worked

Because the operation relied on affiliates, intrusions varied. The sequence below reflects activity commonly reported during the operation and remains relevant because the techniques did not disappear with the brand.

Commonly reported stages of a BlackCat ransomware attack
Stage	Commonly reported activity
Initial access	Compromised or purchased credentials, phishing, exploitation of exposed remote access, and social engineering against help desks.
Escalation and lateral movement	Credential theft, privilege escalation, reconnaissance, and lateral movement using legitimate administrative tools.
Defense evasion	Deletion of volume shadow copies, disabling security controls, and unexpected group policy changes after domain access is obtained.
Exfiltration	Copying data out of the environment before encryption, creating the second extortion lever.
Encryption and extortion	Encryption across Windows, Linux, and virtualization hosts, followed by demands for decryption and non-publication of stolen data.

BlackCat's ability to reach virtualization infrastructure increased the impact of a single intrusion. Encrypting a hypervisor can make many hosted systems unavailable at once, placing more pressure on an organization than encrypting individual machines separately.

Why a defunct operation still matters

A law enforcement disruption followed by a shutdown can create the impression that a threat has been removed. The evidence points to a narrower outcome. The brand was disrupted, but the people and techniques that powered it remained part of the criminal ecosystem.

BlackCat emerged as earlier operations closed. When it ended, its affiliates moved to other ransomware services rather than stopping. A prominent affiliate group known for social engineering against help desks was later observed working with another operation. Its capability, access methods, and target selection continued under a different arrangement.

This is why organizing defense around ransomware brands can create a false sense of progress. A brand is a business arrangement made up of a name, leak site, payment infrastructure, and revenue split. Disrupting that arrangement is valuable because it can stop attacks and help affected organizations recover. The durable elements are the people, their access methods, and their techniques.

An organization that hardened only against BlackCat indicators in early 2024 gained limited protection once the brand disappeared. An organization that hardened against credential abuse, exposed remote access, help-desk manipulation, and encryption of virtualization hosts remained better prepared regardless of the next operation's name.

How to defend against what BlackCat represented

The controls that addressed BlackCat continue to address the operations its affiliates moved to:

Require phishing-resistant MFA on all remote access. Compromised credentials were a primary entry route, and without stronger authentication they can produce a login that looks legitimate.
Reduce and monitor exposed remote access. Remove unnecessary internet-facing remote desktop and administrative services, and monitor what remains for unusual authentication patterns.
Harden the help desk. Require strong identity verification for password and authentication resets. Affiliate groups associated with BlackCat used social engineering to persuade support staff to grant access.
Protect virtualization infrastructure separately. Hypervisor hosts need their own access controls, hardening, and monitoring because encrypting one can affect many systems.
Detect the pre-encryption sequence. Shadow copy deletion, disabled security tools, unexpected group policy changes, internal scanning, and large outbound data transfers all precede encryption and create detection opportunities.
Keep offline backups and test restoration. Data theft means restoration addresses only the availability problem. Organizations also need a plan for notification, investigation, and the possible exposure of stolen information.

Why ransomware brands are the wrong unit of analysis

Security reporting often treats ransomware operations as durable adversaries with fixed identities. BlackCat offers a useful correction. It lasted roughly two years, inherited people from operations that had closed, contributed people to operations that followed, and ended because its operators chose to steal a large ransom from their own affiliate rather than continue the business.

Calling BlackCat an adversary in a threat model gives a temporary business arrangement more permanence than it had. What persists is the tradecraft. That is why Sekoia builds detection around behavior and intelligence. Sekoia is a European cybersecurity vendor whose AI SOC platform correlates activity across endpoint, identity, network, and cloud signals and matches it against behavioral rules mapped to MITRE ATT&CK. Cyber threat intelligence from the in-house Threat Detection & Research (TDR) team adds context about how ransomware operations and their affiliates work.

The practical difference appears when a brand disappears. Detection anchored to a named group's indicators expires with the group. Detection anchored to credential abuse, shadow copy deletion, and encryption of virtualization hosts continues to work because the affiliate using those techniques under one banner may use them under another.

For a security team, the useful question about any ransomware brand is therefore which techniques its affiliates rely on and whether those techniques are covered. Threat landscape names may change within eighteen months. The ways attackers obtain credentials and reach a hypervisor change far more slowly, and that is the list worth working through.