ALPHV, also known as BlackCat and Noberus, was a financially motivated ransomware and data extortion operation first observed in November 2021. The Canadian Centre for Cyber Security assesses it as a Russian-speaking cybercrime group. It operated a ransomware-as-a-service model: administrators maintained the malware and extortion infrastructure, while affiliates conducted intrusions in return for a share of ransom payments.
Its Rust-based ransomware could encrypt Windows and Linux systems and VMware environments. Microsoft’s research documents varied affiliate access methods, including compromised credentials and exploited vulnerabilities. Attacks combined encryption with threats to publish stolen information; some affiliates extorted victims without deploying ransomware.
A joint FBI, CISA and HHS advisory, updated in February 2024, describes help-desk impersonation, credential theft and abuse of legitimate remote-access software. It also identifies increased healthcare targeting after the FBI disrupted the group’s infrastructure in December 2023. The Justice Department said that operation seized websites and provided decryption assistance to victims.
The original service subsequently shut down. Mandiant reported in May 2025 that former affiliate UNC3944 had moved to RansomHub in 2024. Affiliate migration does not establish that RansomHub is an ALPHV rebrand. U.S. sentences announced in April 2026 concerned attacks committed in 2023, rather than establishing renewed operation of the service.
ALPHV/BlackCat victim listing identifying henryschein.com. Contemporary Nov. 2, 2023, reporting attributes theft of 35 TB, repeated encryption and publication threats to the group. Ransomware.live records discovery Dec. 5, 2023; this is not the original claim publication date. Technical claims and actor responsibility remain unverified.
