What is BlackCat (ALPHV) Ransomware?

Key takeaways

• BlackCat, also called ALPHV, was a ransomware-as-a-service operation active from late 2021 into 2024.
• It was among the first major ransomware families built in Rust, running across both Windows and Linux.
• BlackCat used triple extortion, combining encryption, data-leak threats, and denial-of-service pressure.
• It was behind the February 2024 Change Healthcare breach before collapsing later that year.
• Microsegmentation limits how far BlackCat-style affiliates can move, including into virtualization infrastructure.

What is BlackCat (ALPHV) ransomware?

BlackCat was a ransomware family and the operation behind it, run as a service for affiliates. Security researchers linked it to veteran affiliates from the earlier DarkSide and BlackMatter operations. Its Rust codebase gave affiliates a configurable payload that ran reliably across mixed environments, including VMware ESXi hosts that run many virtual machines at once.

How did BlackCat (ALPHV) ransomware work?

BlackCat worked through affiliate-run intrusions that combined credential theft, lateral movement, and broad encryption. Affiliates gained access through stolen credentials, exposed services, and social engineering. Some campaigns involved the Scattered Spider group, which specialized in help-desk social engineering to gain access. Inside the network, affiliates moved across hosts, stole data for extortion, and targeted virtualization infrastructure to maximize impact. BlackCat used triple extortion, adding denial-of-service and direct pressure on victims alongside encryption and data leaks.

Targeting ESXi hosts raised the stakes of internal movement. Reaching a single hypervisor could take down many virtual machines at once.

What were notable BlackCat (ALPHV) attacks?

Over roughly two years of activity, the group was connected to more than 1,000 victims, as documented by the Department of Justice. The group made global headlines repeatedly, most notably with the early 2024 attack involving Change Healthcare, a UnitedHealth Group subsidiary (more on this below).

In September 2023, BlackCat affiliates teamed up with the social-engineering crew Scattered Spider to breach two notable casino resorts, MGM Resorts and Caesars Entertainment. Through social engineering tactics, they convinced the MGM Help Desk to reset the multi-factor authentication (MFA) credentials for an MGM staff member. From that foothold, they encrypted over 100 ESXi hypervisors at MGM, taking down slot machines, digital room keys, and reservation systems. Caesars reportedly paid $15 million in ransom; MGM chose not to pay but suffered approximately $100 million in losses.

BlackCat's reach went far beyond casinos. For example, in 2023, BlackCat claimed responsibility for a breach of Reddit and demanded $4.5 million to delete 80GB of data it said it had stolen. BlackCat also breached Western Digital and Canadian software firm Constellation Software in 2023. BlackCat's victims spanned construction, retail, insurance, and pharmaceuticals, demonstrating how wide a net the affiliate model cast.

What was the BlackCat "exit scam," and what caused it?

In February 2024, BlackCat affiliates successfully breached Change Healthcare in what became the group's most consequential attack. The breach caused catastrophic disruptions in insurance claims and payment processing across the U.S. healthcare system.

The following month, Change Healthcare reportedly paid a $22 million ransom in an effort to make the crisis go away. But BlackCat's core operators kept the entire payment and never paid the affiliate who carried out the breach its promised cut.

Researchers quickly recognized the pattern of an exit scam: a staged law enforcement banner, a false "seized" claim, and a vanished payout. Security researcher Fabian Wosar of Emsisoft called it a textbook exit scam. “There is absolutely zero reason why law enforcement would just put a saved version of the takedown notice up during a seizure instead of the original takedown notice,” Wosar said on X.

The fallout between BlackCat and its affiliates didn't end there. The scammed affiliate still held the stolen data and used it to launch a second extortion attempt against Change Healthcare through an entirely different hacker group named RansomHub. The underlying takeaway from the incident: two extortion attempts, only one ransom payment delivered, zero guarantees.

Why did BlackCat target healthcare and hospitality so aggressively?

Healthcare and hospitality share the same structural vulnerabilities that BlackCat built its attack around: virtualized environments where many applications, from patient records to hotel key card systems, run on shared hypervisors with very little internal isolation. An attacker who compromises an ESXi host in this environment can disrupt every virtual machine running on it at once. That dynamic explains both outcomes: BlackCat affiliates took down MGM's slot machines and room access, and Change Healthcare's claims processing.

These verticals are facing greater pressure to pay. Downtime at a hospital or on a casino floor is immediately visible to patients and customers, giving attackers more leverage than they would have in most other industries. In fact, the Change Healthcare breach impacted approximately 100 million people, all from a single intrusion in this type of environment.

Is BlackCat (ALPHV) ransomware still active?

BlackCat is no longer active. The FBI seized parts of its infrastructure in December 2023. After the Change Healthcare ransom in early 2024, the operators shut down the operation and disappeared, in what researchers described as an exit scam against their own affiliates. As of 2026, there is no confirmation that the original ALPHV operation has resumed, though former affiliates have continued their work under other brands.

What should you do after a BlackCat-style attack?

BlackCat focused its attacks on virtualized infrastructure. For this reason, remediating an attack requires isolating all affected ESXi hosts and hypervisor management interfaces, as a single compromised host can bring down dozens of virtual machines.

From there, follow your organization's predetermined incident response plan designed around affiliate-driven, multi-platform attacks:

1. Disable compromised accounts, rotate credentials, and revoke all access tokens and MFA resets tied to help desk accounts, as this is an often-used entry point by BlackCat's Scattered Spider affiliates.
2. Preserve hypervisor and virtualization management logs, along with other forensic evidence, before rebuilding any system - this information is useful for insurance claims and investigations.
3. Identify what data was exfiltrated and determine who has been impacted (e.g., individual users, patients, vendors, partners, etc.) and prepare required notifications.
4. Rebuild using clean, verified images rather than existing snapshots, which may already be compromised. BlackCat's exit-scam history is also a reminder that paying for a decryption key is no guarantee of getting one.

Loop in law enforcement early. During its 2023 takedown, the FBI developed a functioning decryption tool and offered it to more than 500 victims. Checking whether your case matches an existing decryption key may be worth the call to law enforcement.

How do you contain a BlackCat-style attack?

You contain a BlackCat-style attack by restricting internal movement and isolating high-value infrastructure such as hypervisors. Because affiliates moved laterally to reach data and virtualization hosts, controlling that movement directly reduces the blast radius.

Illumio Insights helps security teams identify risky connections and suspicious lateral movement across hybrid environments. Microsegmentation solutions then apply least-privilege policies that isolate workloads and permit only required connections, keeping a compromised host from reaching ESXi management interfaces and other critical systems. These policies apply across Windows and Linux, matching the cross-platform reach of the payload. An affiliate who gains a foothold finds the routes to virtualization infrastructure and sensitive data already closed. This is breach containment applied to an affiliate-driven, cross-platform threat.

Frequently asked questions about BlackCat (ALPHV) ransomware

What type of malware is BlackCat?

BlackCat, also called ALPHV, was ransomware operated as a service and written in Rust, capable of running on both Windows and Linux systems.

Why was BlackCat significant?

BlackCat was one of the first major Rust-based ransomware families and was behind the 2024 Change Healthcare breach, one of the most disruptive healthcare attacks on record.

Is BlackCat still active?

No. The operation collapsed in 2024 following an FBI infrastructure seizure and an apparent exit scam, though former affiliates moved to other groups.

Can microsegmentation stop a BlackCat-style attack?

Yes. Microsegmentation isolates workloads and virtualization infrastructure, closing the internal routes affiliates use to reach hypervisors and sensitive data.