ALPHV BlackCat showed how far a ransomware-as-a-service brand can reach when skilled affiliates bring their own identity attacks: help desk impersonation, MFA interception and stolen remote access logins. The operation ran from late 2021 until it vanished in March 2024, weeks after the Change Healthcare attack, yet its affiliates and tradecraft moved on to other brands. This profile draws on the joint #StopRansomware advisory AA23-353A from the FBI, CISA and HHS, the US Department of Justice, MITRE ATT&CK v20, Microsoft and the HHS Health Sector Cybersecurity Coordination Center. It covers names, the affiliate model and its collapse, techniques mapped to ATT&CK, identity abuse, and the defences that still apply. It is written for security operations, identity and healthcare security teams; it contains no leak-site material and names no individuals.
Key takeaways
- The brand ended but the affiliates did not. ALPHV shut its infrastructure in March 2024 in what reporting described as an exit scam; the Change Healthcare data later surfaced with RansomHub, so defend against the techniques, not the name.
- Identity attacks were the main entry. AA23-353A describes affiliates posing as IT or help desk staff by phone or SMS to obtain credentials, and using Evilginx2 to capture MFA codes and session cookies.
- Remote access without MFA was decisive. Change Healthcare's CEO told Congress the compromised Citrix portal did not have multi-factor authentication; ALPHV claimed the attack and UnitedHealth paid USD 22 million.
- Healthcare was singled out. After the December 2023 law enforcement action, the advisory reports an ALPHV administrator encouraging affiliates to target hospitals, and healthcare became the most commonly victimised sector.
- The controls are known. Phishing-resistant MFA, verified help desk resets, allowlisted remote access tools, tier 0 protection for backup and hypervisor credentials, and immutable backups address most of what affiliates did.
Who they are (names and aliases)
The Department of Justice describes ALPHV, also known as BlackCat and Noberus, as the second most prolific ransomware-as-a-service variant in the world over the 18 months before December 2023. MITRE ATT&CK tracks the encryptor as software S1068, first observed in November 2021 and written in Rust. ATT&CK has no separate group entry for the operators, because the intrusions were carried out by many affiliates.
| Name or ID | Source | What it refers to |
|---|---|---|
| BlackCat (S1068) | MITRE ATT&CK | The Rust encryptor; ATT&CK aliases ALPHV and Noberus; encrypts Windows, Linux and VMware instances |
| ALPHV, Noberus | Department of Justice, MITRE ATT&CK | Names for the same RaaS operation |
| Sphynx | AA23-353A | Rewritten "Ransomware 2.0" version announced in February 2023 with added evasion and affiliate tooling |
| ExMatter | HHS HC3 | Data exfiltration tool used with BlackCat, updated in August 2022 to target specific file types |
| Affiliates: Scattered Spider (G1015) | MITRE ATT&CK | ATT&CK records Scattered Spider deploying BlackCat |
| Affiliates: Pistachio Tempest, Velvet Tempest | Microsoft | Formerly DEV-0237 (also FIN12) and DEV-0504, both previously deploying other RaaS families |
HHS HC3 notes that BlackCat is believed to be a successor to the DarkSide and BlackMatter operations; treat this as an assessment, not a proven lineage. See the Threat Actor Groups Guide for how naming schemes relate.
Targeting and motivation
- Motivation: financial. The Department of Justice says the group's affiliates targeted more than 1,000 victims and received hundreds of millions of dollars in ransom payments.
- Affiliate model: the operators developed the encryptor, ran the leak and negotiation sites, and recruited affiliates who breached networks and deployed it. HC3 notes affiliates also bought access to networks on underground forums.
- Sectors and regions: ATT&CK records victims across Africa, the Americas, Asia, Australia and Europe in many sectors. HC3 warned of continued targeting of healthcare and public health.
- Retaliatory targeting: AA23-353A says that of nearly 70 victims leaked since mid-December 2023, healthcare was the most commonly victimised, following the administrator's call to target hospitals.
- Extortion beyond encryption: the advisory records affiliates extorting without deploying ransomware, offering unsolicited "vulnerability reports" as an incentive to pay, and HC3 notes DDoS against victims who refused. See the Ransomware Negotiation Guide.
Disruption and exit
| Date | Event | Source |
|---|---|---|
| November 2021 | BlackCat first observed | MITRE ATT&CK, HHS HC3 |
| April 2022 | FBI FLASH publishes BlackCat indicators | AA23-353A |
| February 2023 | Sphynx version announced | AA23-353A |
| 19 December 2023 | Justice Department announces disruption; FBI decryptor offered to more than 500 victims, sparing ransom demands of about USD 68 million; joint advisory published | Department of Justice, AA23-353A |
| 21 February 2024 | Ransomware deployed at Change Healthcare after access on 12 February | NHI Mgmt Group breach analysis |
| 27 February 2024 | Advisory updated with healthcare targeting and new IOCs | AA23-353A |
| 5 March 2024 | Leak and negotiation sites go offline behind a seizure banner; Europol and the UK NCA told reporters they were not involved, and an affiliate claimed the operators kept the USD 22 million Change Healthcare payment | BleepingComputer |
Tactics and techniques (MITRE ATT&CK)
IDs below are ATT&CK v20 entries recorded against S1068 or techniques AA23-353A and Microsoft describe. Defence impairment now sits under tactic TA0112 Defense Impairment.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Reconnaissance | T1598 Phishing for Information | Open source research on staff, then calls or SMS posing as IT or help desk | Verified identity checks at the help desk |
| Credential access | T1557 Adversary-in-the-Middle; T1539 Steal Web Session Cookie | Evilginx2 capturing MFA codes, passwords and session cookies | FIDO2 or PKI-based MFA bound to origin |
| Initial access | T1133 External Remote Services; T1078 Valid Accounts; T1190 Exploit Public-Facing Application | Compromised credentials on RDP and remote access portals; unpatched Exchange (Microsoft) | MFA on all remote access; patch KEV flaws |
| Command and control | T1219.002 Remote Desktop Software; T1572 Protocol Tunneling | AnyDesk, Splashtop, ScreenConnect, SimpleHelp, MeshCentral; Plink and Ngrok; Brute Ratel C4 and Cobalt Strike | Allowlist approved remote tools |
| Credential access | T1003.001 LSASS Memory; T1558 Steal or Forge Kerberos Tickets; T1555 Credentials from Password Stores | Mimikatz, Rubeus, WDigest enabled for cleartext (Microsoft); passwords from domain controllers and backup servers (AA23-353A) | Credential Guard; disable WDigest; isolate backup credentials |
| Persistence | T1136.002 Domain Account | User account named "aadmin" created | Alert on account creation |
| Lateral movement | T1570 Lateral Tool Transfer; T1569.002 Service Execution | Encryptor spreads with PsExec using embedded credentials | Block PsExec and WMI process creation where not needed |
| Defence impairment | T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs | POORTRY and STONESTOP to kill security processes; wevtutil log clearing; Exchange logs cleared | Tamper protection; forward logs off-host |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Mega.nz and Dropbox; ExMatter; Rclone (Microsoft) | Egress controls on servers |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1561.001 Disk Content Wipe | Encryption of Windows, Linux and VMware; shadow copies deleted; VM snapshots wiped | Immutable, offline backups |
Microsoft notes the payload needs an access token on its command line to run, which defenders can hunt for in process telemetry.
How they abuse identities and credentials
Human identities
- Help desk social engineering: affiliates researched employees and then posed as IT staff to get credentials, or posed as the employee to the help desk. The MGM Resorts breach, claimed by ALPHV and reported as the work of a Scattered Spider affiliate, began with a help desk call that led to identity provider admin access. See the Account Recovery and Help Desk Security Guide.
- MFA interception: Evilginx2 proxies the real login page and captures the session cookie after MFA completes, so OTP and push factors give no protection. See the AiTM Phishing Guide.
- Single-factor remote access: in the Change Healthcare breach compromised credentials opened a Citrix portal without MFA on 12 February 2024, with encryption nine days later and 192.7 million people ultimately affected.
Privileged and non-human identities
- Embedded domain credentials: HC3 notes the encryptor can be configured with domain credentials to spread through PsExec. Any credential an affiliate obtains becomes a deployment key, so tier 0 accounts must never log on to ordinary servers where they can be harvested.
- Backup server secrets: AA23-353A reports passwords harvested from backup servers. Backup service accounts with domain admin rights hand over both data and the means to stop recovery. See the Backup Identity Isolation Guide.
- Kerberos tickets: Rubeus and Kerberos ticket generation give domain access without a password. Service accounts with weak passwords are the usual target; replace them with group managed service accounts. See the Credential Dumping Guide.
- Hypervisor access: encryption of VMware instances requires hypervisor credentials. See the ESXi Ransomware Playbook.
Notable incidents
| When | Victim | What sources describe |
|---|---|---|
| September 2023 | MGM Resorts | ALPHV claimed the attack and said it encrypted more than 100 ESXi hypervisors (not confirmed by MGM); MGM's 8-K estimated about USD 100 million impact |
| February 2024 | Change Healthcare | Citrix login without MFA; USD 22 million paid by UnitedHealth; nationwide claims and pharmacy disruption; data later held by RansomHub |
The pattern of affiliates switching brands is why the RansomHub Threat Actor Profile and the Scattered Spider Threat Actor Profile are useful companions to this page.
Detection and defence
Phased response for a defender
- First week, close single-factor remote access: list every VPN, Citrix, RDP gateway and remote support portal and confirm MFA for every account. Where MFA is impossible, restrict by source address and schedule replacement.
- Harden the help desk: require call-back to a number on file, manager approval or in-person verification before any password or MFA reset for privileged users. Log every reset and alert on resets followed by new MFA device registration.
- Move administrators to phishing-resistant MFA: FIDO2 security keys or platform passkeys, as AA23-353A recommends. Pilot with IT staff, keep a break-glass account, then extend. See the Phishing-Resistant MFA Guide.
- Allowlist remote access tools: the advisory asks for application control that blocks unlisted and portable remote access software. Run in audit mode first and roll back by returning the policy to audit.
- Protect credentials: enable Credential Guard and LSA protection, keep WDigest disabled, use LAPS for local admin passwords, and apply attack surface reduction rules for LSASS theft and PsExec or WMI process creation, as Microsoft recommends.
- Isolate recovery: separate backup and hypervisor administration from the production domain and keep immutable offline copies.
What to log and alert on
| Signal | Source | Why it matters |
|---|---|---|
| Password or MFA reset followed by new MFA device registration within an hour | Identity provider audit logs, help desk tickets | Help desk impersonation pattern |
| Session token used from a new ASN or device shortly after sign-in | Identity provider sign-in logs | AiTM session cookie replay |
| Events 4720 and 4728 (account created, added to a privileged group) | Domain controller Security log | New accounts such as "aadmin" |
| Registry change setting UseLogonCredential to 1 under WDigest | Sysmon event 13, EDR | Enables cleartext credential theft |
| Command lines containing --access-token; PsExec service creation (event 7045) | EDR, System log | BlackCat execution and spreading |
| Event 1102 (Security log cleared), wevtutil cl; Mega, Dropbox or Ngrok traffic from servers | Security log, proxy and DNS logs | Defence impairment and exfiltration |
Metrics that show it is working
- Phishing-resistant MFA coverage: share of privileged and remote access accounts on FIDO2 or PKI-based factors.
- Verified reset rate: share of privileged credential resets with documented out-of-band verification; target 100 per cent.
- Unapproved remote tools: count of remote access products seen in EDR beyond the approved list; target zero.
- Privileged change triage time: minutes from a 4728 event on a tier 0 group to analyst review.
- Restore success: share of quarterly restore tests that meet the recovery time objective.
Decision guidance
Smaller organisations get the most from MFA on every remote access path, a simple call-back rule at the help desk, a managed detection service that watches identity logs, and an offline backup. Larger organisations, especially in healthcare, should move administrators to phishing-resistant MFA, treat identity provider, backup and hypervisor administration as tier 0, and run tabletop exercises against an affiliate that already has valid credentials. See the Healthcare Identity Security Guide.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| MFA on remote and privileged access | AC-17, IA-2(1) | PR.AA-03 |
| Social engineering awareness | AT-2 | PR.AT-01 |
| Least privilege for admin accounts | AC-6(5) | PR.AA-05 |
| Allowlist remote access software | CM-7(5) | PR.PS-02 |
| Monitoring and log review | SI-4, AU-6 | DE.CM-01, DE.CM-03 |
| Protected backups | CP-9 | PR.DS-11 |
Practitioner checklist
- Enforce MFA on every VPN, Citrix, RDP and remote support portal, with no single-factor exceptions.
- Require out-of-band verification for privileged password and MFA resets at the help desk.
- Move administrators to FIDO2 or PKI-based MFA to defeat AiTM kits such as Evilginx2.
- Block unapproved and portable remote access tools with application control.
- Enable Credential Guard and LSA protection, keep WDigest disabled and deploy LAPS.
- Alert on new privileged accounts, log clearing and --access-token command lines.
- Separate backup and hypervisor credentials from the production domain and keep immutable backups.
- Track affiliates, not brands: map detections to the techniques in AA23-353A and test them.
Standards and references
- FBI, CISA and HHS: #StopRansomware: ALPHV Blackcat (AA23-353A)
- US Department of Justice: Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant
- MITRE ATT&CK: BlackCat (S1068)
- MITRE ATT&CK: Scattered Spider (G1015)
- HHS HC3: BlackCat Analyst Note
- Microsoft: The many lives of BlackCat ransomware
- BleepingComputer: BlackCat ransomware shuts down in exit scam, blames the "feds"
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Ransomware Groups Guide · Scattered Spider Threat Actor Profile · Medusa Ransomware Threat Actor Profile · Phishing-Resistant MFA Guide · Ransomware Response and Recovery Guide