ALPHV / BlackCat
View MITRE Group Page ↗Key Facts
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G1014 (ALPHV / BlackCat).
- Linked to 2 primary court prosecution records.
- Identified 0 individually charged operatives.
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1078 Valid Accounts | 1 incidents |
| T1486 Data Encrypted for Impact | 1 incidents |
| T1567 Exfiltration Over Web Service | 1 incidents |
| T1041 Exfiltration Over C2 Channel | 1 incidents |
| T1133 External Remote Services | 1 incidents |
| T1087 Account Discovery | 1 incidents |
Prosecution Cases Attributed to This Actor
ALPHV / BlackCat Ransomware Attack on Change Healthcare
Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
Change Healthcare Ransomware Outage (ALPHV / BlackCat)
Nationwide healthcare billing and pharmacy clearinghouse paralyzed by an ALPHV/BlackCat ransomware deployment. Threat actors gained initial access through an unmonitored Citrix portal server lacking multi-factor authentication, exfiltrating 6 terabytes of protected health data and forcing a 350 Bitcoin ($22 million) extortion payout amidst an estimated $3+ billion systemic recovery cost.
Treasury OFAC Sanctions Actions
Up to $10,000,000 reward for information leading to identification of leaders of the ALPHV/BlackCat ransomware group responsible for Change Healthcare outage.
Official Treasury Press Release ↗Targeted Defensive Hardening for ALPHV / BlackCat
Primary Initial Access Defense
Enforce hardware FIDO2 multi-factor authentication across all perimeter VPN, Citrix, and cloud data portals. Prohibit SMS or push-based MFA that can be bypassed via vishing or SIM swapping.
Lateral Movement Interception
Restrict internal SMB (port 445) and RPC traversal between workstation subnets. Implement tiered Active Directory administration so domain administrator credentials are never cached on endpoints.