{"id":222523,"date":"2022-01-26T20:03:00","date_gmt":"2022-01-26T19:03:00","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=222523"},"modified":"2022-01-26T20:03:00","modified_gmt":"2022-01-26T19:03:00","slug":"alphv-ransomware-gang-analysis","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/alphv-ransomware-gang-analysis\/","title":{"rendered":"ALPHV ransomware gang analysis"},"content":{"rendered":"\n\n\n\n[et_pb_section][et_pb_row][et_pb_column type=\u00a0\u00bb4_4″][et_pb_text]\n

ALPHV<\/strong> (or BlackCat or Noberus<\/strong>) ransomware<\/strong> emerged only last December<\/strong> and is already considered as a genuine threat<\/strong> that blue teams should be ready to fight against while little is known on the employed entry vector(s).<\/p>\n\n\n\n

This conjecture relies not only on the high level of developing skills<\/strong> required to build such peculiar ransomware payloads and dedicated leak sites<\/strong> but also more resilient and secure architecture<\/strong>; the number of high-profile victims is already growing at a fast pace <\/strong>and could keep switching between big and mid game hunting <\/strong>in the coming months\/years. Moreover, though not yet proven, ALPHV<\/strong> intends to embrace a triple extortion scheme<\/strong> by launching DDoS<\/strong> towards victims\u2019 assets if the ransom is not paid.<\/p>\n\n\n\n

As far as the threat genealogy<\/strong> is concerned, Darkweb forum analysis<\/strong> allows us to conjecture that at least one actor (affiliate and\/or operator and\/or web developer) with recent or past ties to Darkside\/BlackMatter\/REvil<\/strong> decided to jump into a new RaaS<\/strong> program referred to as ALPHV<\/strong>. In addition, we found that another actor could have been somewhat involved in the LockBit<\/strong> and\/or the ALPHV RaaS program. <\/strong>After pivoting from its avatar, we found with medium high confidence that the ransomware brand was inspired by a cult Russian movie where the Black Cat<\/strong> gang leaves a cat drawing or an actual cat at the scene of the crime.<\/p>\n\n\n\n

Last but not least, we found a running tool being leveraged by affiliates of ALPHV<\/strong> to download and run payloads upon an attack, from a remote server, which possesses strong code overlap with the LockBit\u2019s<\/strong> running tool.<\/p>\n\n\n\n

At the end of the document, we provide actionable intelligence to strengthen relevant layers of defences<\/strong> seeking to reduce or pre-empt the impact of this emerging threat.<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

Table of contents<\/h3>\n\n\n\n