Cicada3301

Cicada3301 began advertising on darknet forums and recruiting affiliates around late June 2024, listing its first victims soon after (initially mostly in the US and UK). The ransomware is written in Rust and targets both Windows and Linux/ESXi environments, and analysts (SecurityWeek, Truesec, IBM and others) documented multiple similarities to ALPHV/BlackCat's encryptor and operational style following ALPHV's early-2024 exit scam.

Whether Cicada3301 is a direct ALPHV/BlackCat rebrand or an unrelated crew that acquired the leaked/sold source code remains unresolved; the group markets its RaaS aggressively, reportedly offering affiliates around a 20% cut and providing a web panel for victim management, chats and negotiations. Security researchers subsequently reported infiltrating the affiliate program, yielding additional insight into its operations.

Cicada3301 remained active through 2025 with a global victim spread. Its MENA-relevant claims include Jordan, Tunisia and the UAE. As with all RaaS leak-site postings, individual victim claims should be treated as unverified unless independently confirmed by a reputable source or the affected organization.