What is BlackCat (ALPHV) Ransomware?

BlackCat (ALPHV) Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Multi-platform (Windows/Linux/ESXi); Rust-written ransomware

Source Attribution

Origin: MITRE
Source: CISA advisory AA23-306A · MITRE ATT&CK
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA advisory AA23-306A · MITRE ATT&CK · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2021-11 discovered BlackCat first observed
2023-12 updated CISA advisory AA23-306A published

Quick Answer

BlackCat affiliates use compromised credentials, PowerShell lateral movement and targeted encryption, with a dedicated leak site for stolen data.

Definition

BlackCat/ALPHV is a Rust-based RaaS family targeting Windows, Linux and ESXi environments, notable for implementing double extortion and a data-leak site.

Overview

BlackCat/ALPHV is a Rust-based RaaS family targeting Windows, Linux and ESXi environments, notable for implementing double extortion and a data-leak site.

Behavior

Rust-written, cross-platform
ESXi encryption module
Private data-leak site

First Seen

2021-11

Target

Multi-platform (Windows/Linux/ESXi); Rust-written ransomware

Techniques: T1486, T1552, T1078
Campaigns: n/a
Related CVEs: CVE-2023-0669

Malware Intelligence

Family: BlackCat (ALPHV) Ransomware

Aliases: BlackCat, ALPHV, Noberus

Techniques: T1486, T1552, T1078

Targets: Multi-platform (Windows/Linux/ESXi); Rust-written ransomware

Behavior:

Rust-written, cross-platform
ESXi encryption module
Private data-leak site

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating BlackCat (ALPHV) Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about BlackCat (ALPHV) Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.