BlackCat (ALPHV)

THREAT ACTOR PROFILE

BlackCat (ALPHV)

BlackCat, also called ALPHV, was one of the most capable ransomware-as-a-service operations of its era, notable for a Rust-based encryptor and a searchable victim-data leak site. It descended from the DarkSide and BlackMatter crews and ran high-impact attacks against healthcare and critical infrastructure before an apparent exit scam in 2024.

Russian-speaking operation

Ransomware (healthcare, infrastructure)

First seen

2021

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

ALPHV, Noberus and the DarkSide lineage

BlackCat is tracked under several names reflecting its lineage from earlier crews. They map to one entry among tracked ransomware and espionage groups, so an ALPHV advisory and a Noberus report read as one operation.

GROUP PROFILE

A Rust-based RaaS with a DarkSide pedigree

BlackCat ran a ransomware-as-a-service operation: the core team maintained the encryptor and leak site, and affiliates ran intrusions. It is widely assessed as a Russian-speaking operation and is tied by code and personnel to the earlier DarkSide and BlackMatter crews.

Our record ties it to ransomware against healthcare, critical infrastructure and many other sectors. After its 2024 exit scam, many affiliates moved to brands like RansomHub.

BlackCat stood out for engineering and for aggressive pressure tactics. It built one of the first Rust-based ransomware families, released a searchable site for stolen data, and in one case filed a complaint with the US SEC against a victim that had not disclosed a breach.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Affiliate access into Rust-based encryption

The stages below come from ALPHV/BlackCat activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

The ALPHV encryptor and its lineage

Initial Access

CVES EXPLOITED

Veritas Backup Exec for initial access

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

BlackCat (ALPHV)

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

BlackCat (ALPHV)

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

BlackCat (ALPHV)

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Backup Exec access and healthcare pressure

The reporting tracks an operation that paired engineering with aggressive extortion.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.