ALPHV

ALPHV (also marketed as BlackCat or Noberus) was a ransomware-as-a-service (RaaS) group that emerged in November 2021 and quickly became one of the most prolific extortion operations of the following two years. It was notable for being among the first major ransomware families written in Rust, a memory-safe systems language that complicated reverse engineering and allowed cross-platform binaries targeting Windows, Linux, and VMware ESXi hypervisors.

The group operated on an affiliate model: core developers maintained the malware and negotiation infrastructure, while affiliates carried out intrusions and split ransom payments, typically keeping 80–90%. ALPHV was widely assessed by Western researchers and the US Department of Justice to be a successor or rebrand of the DarkSide and BlackMatter crews, the same lineage responsible for the May 2021 Colonial Pipeline attack.

ALPHV pioneered several extortion innovations, including a public, indexed leak site that allowed victims' customers and employees to search stolen data, and the filing of a SEC complaint against victim MeridianLink in November 2023 for allegedly failing to disclose a breach within the new four-day rule.

Major incidents attributed to ALPHV or its affiliates include attacks on MGM Resorts and Caesars Entertainment (September 2023), Reddit (February 2023), and Change Healthcare, a UnitedHealth subsidiary, in February 2024. The Change Healthcare incident disrupted US pharmacy claims processing for weeks and reportedly involved a $22 million payment.

In December 2023, the FBI, working with international partners, seized ALPHV's leak site and released a decryption tool said to have helped roughly 500 victims. The group briefly resurfaced before executing an apparent exit scam in March 2024, shutting down infrastructure after the Change Healthcare payment without compensating the affiliate responsible. Many former affiliates are believed to have migrated to RansomHub and other successor brands.