Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
ALPHV/BlackCat was a sophisticated Rust-based ransomware-as-a-service operation, notable as one of the first major Rust ransomware families, that collapsed in an apparent exit scam in early 2024.
First observed in November 2021, ALPHV/BlackCat was written in Rust and offered via an affiliate RaaS model, targeting organizations across the Americas, Europe, Africa, Asia and Australia. It ran a searchable leak site, pioneered triple-extortion pressure tactics, and drew a joint CISA/FBI advisory (AA23-353A) in December 2023.
In early 2024, after the extortion of Change Healthcare, the operation abruptly shut down in what researchers widely assess was an exit scam: affiliates were reportedly denied payment while leadership disappeared with funds and a fake law-enforcement 'seizure' banner was posted. The reputational damage ended the brand's ability to attract affiliates. Displaced affiliates are widely assessed to have migrated to successor operations such as RansomHub, and researchers have discussed Embargo as a possible rebrand based on infrastructure overlaps.
During its active period, ALPHV/BlackCat listed victims in Egypt and Saudi Arabia, among many other countries, on its leak site. These listings were extortion claims and should be treated as unverified allegations unless confirmed by the affected organization or a reputable authority.
+33 more relationships — see the relationships browser.