The Demon BlackCat, the Rusty Black Cat

Legend

Appearing in November 2021, it was the first major ransomware written in Rust, able to hit Windows, Linux and VMware ESXi. In December 2023 the FBI disrupted it and handed a decryptor to hundreds of victims. In 2024, after the Change Healthcare attack, its leaders vanished with the ransom, scamming their own affiliates.

Exorcism

Cast it out by guarding hypervisors like the most precious servers: isolated management access, MFA and patches. Stolen credentials are its favourite door: no remote access without a second factor.

Technical record

Also known as: ALPHV, Noberus
Circle: Circle III · Ransomware and extortion
First seen: 2021
Status: Exorcised (FBI disruption of ALPHV/BlackCat, 2023-12-19)
Works: The Scourge of MGM, When the House Lost · The Scourge of Change Healthcare

Ransomware-as-a-service first seen in November 2021, notable as the first major ransomware written in Rust and able to target Windows, Linux and VMware ESXi. The FBI disrupted it in December 2023 and released a decryptor to over 500 victims. After the 2024 Change Healthcare attack its operators staged an apparent exit scam and went dark.

Sources: attack.mitre.org · justice.gov · cisa.gov · MITRE ATT&CK reference S1068