ALPHV (BlackCat)
A ransomware-as-a-service operation that emerged in late 2021, disrupted by the FBI in December 2023, which vanished in March 2024 with the Change Healthcare ransom in an exit scam.
ALPHV rented its software to affiliates who carried out intrusions and split ransoms with the operators. Written in a modern language and adaptable to several operating systems, it was used against hospitals, casinos and infrastructure. Its history shows two limits of the usual response to ransomware. First, a law enforcement disruption does not end a group: ALPHV resumed operations days after the FBI action. Second, paying buys no guarantee: its operators cheated their own affiliate, and a paying victim's data was put up for extortion again by another group. For an insurer that reimburses a ransom, the case is a reminder that a promise to delete data has no enforceable value.
On December 19, 2023, the FBI announced it had provided a decryption tool to more than 500 ALPHV victims. On February 21, 2024, an affiliate attacked Change Healthcare, which paid about 22 million dollars in bitcoin in early March; the operators then posted a fake law enforcement seizure notice and vanished without paying the affiliate, who took the data to another group.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.