Latest BlackCat news

BlackCat ransomware hits Azure Storage with Sphynx encryptor

The BlackCat (ALPHV) ransomware gang now uses stolen Microsoft accounts and the recently spotted Sphynx encryptor to encrypt targets' Azure cloud storage.
- Sergiu Gatlan
- September 16, 2023
- 10:11 AM
- 0
MGM casino's ESXi servers allegedly encrypted in ransomware attack

An affiliate of the BlackCat ransomware group, also known as APLHV, is behind the attack that disrupted MGM Resorts' operations, forcing the company to shut down IT systems.
- Ionut Ilascu
- September 14, 2023
- 06:52 PM
- 3
Japanese watchmaker Seiko breached by BlackCat ransomware gang

The BlackCat/ALPHV ransomware gang has added Seiko to its extortion site, claiming responsibility for a cyberattack disclosed by the Japanese firm earlier this month.
- Bill Toulas
- August 21, 2023
- 10:40 AM
- 0
The Week in Ransomware - August 18th 2023 - LockBit on Thin Ice

While there was quite a bit of ransomware news this week, the highlighted story was the release of Jon DiMaggio's third article in the Ransomware Diaries series, with the focus of this article on the LockBit ransomware operation.
- Lawrence Abrams
- August 18, 2023
- 05:07 PM
- 0
Microsoft: BlackCat's Sphynx ransomware embeds Impacket, RemCom

Microsoft has discovered a new version of the BlackCat ransomware that embeds the Impacket networking framework and the Remcom hacking tool, both enabling spreading laterally across a breached network.
- Lawrence Abrams
- August 17, 2023
- 06:05 PM
- 0
The Week in Ransomware - July 28th 2023 - New extortion tactics

With ransom payments declining, ransomware gangs are evolving their extortion tactics to utilize new methods to pressure victims.
- Lawrence Abrams
- July 28, 2023
- 04:01 PM
- 0
New Nitrogen malware pushed via Google Ads for ransomware attacks

A new 'Nitrogen' initial access malware campaign uses Google and Bing search ads to promote fake software sites that infect unsuspecting users with Cobalt Strike and ransomware payloads.
- Bill Toulas
- July 26, 2023
- 11:04 AM
- 0
ALPHV ransomware adds data leak API in new extortion strategy

The ALPHV ransomware gang, also referred to as BlackCat, is trying to put more pressure on their victims to pay a ransom by providing an API for their leak site to increase visibility for their attacks.
- Ionut Ilascu
- July 26, 2023
- 02:34 AM
- 0
The Week in Ransomware - July 21st 2023 - Avaddon Back as NoEscape

This edition of the Week in Ransomware covers the last two weeks of news, as we could not cover it last week, and includes quite a bit of new information, including the return of the Avaddon ransomware gang.
- Lawrence Abrams
- July 21, 2023
- 04:01 PM
- 2
Estée Lauder beauty giant breached by two ransomware gangs

Two ransomware actors, ALPHV/BlackCat and Clop, have listed beauty company Estée Lauder on their data leak sites as a victim of separate attacks.
- Ionut Ilascu
- July 19, 2023
- 07:51 PM
- 0
FIN8 deploys ALPHV ransomware using Sardonic malware variant

A financially motivated cybercrime gang has been observed deploying BlackCat ransomware payloads on networks backdoored using a revamped Sardonic malware version.
- Sergiu Gatlan
- July 18, 2023
- 09:15 AM
- 0
BlackCat ransomware pushes Cobalt Strike via WinSCP search ads

The BlackCat ransomware group (aka ALPHV) is running malvertizing campaigns to lure people into fake pages that mimic the official website of the WinSCP file-transfer application for Windows but instead push malware-ridden installers.
- Bill Toulas
- July 01, 2023
- 11:18 AM
- 0
The Week in Ransomware - June 23rd 2023 - The Reddit Files

It was a relatively quiet week regarding ransomware news, with the BlackCat ransomware gang extorting Reddit and the ongoing MOVEit Transfer data breaches being the main focus.
- Lawrence Abrams
- June 23, 2023
- 06:49 PM
- 0
Reddit hackers threaten to leak data stolen in February breach

The BlackCat (ALPHV) ransomware gang is behind a February cyberattack on Reddit, where the threat actors claim to have stolen 80GB of data from the company.
- Lawrence Abrams
- June 18, 2023
- 12:01 PM
- 6
The Week in Ransomware - June 9th 2023 - It’s Clop... Again!

The week was dominated by fallout over the MOVEit Transfer data-theft attacks, with the Clop ransomware gang confirming that they were behind them.
- Lawrence Abrams
- June 09, 2023
- 06:44 PM
- 0
BlackCat ransomware fails to extort Australian commercial law giant

Australian law firm HWL Ebsworth confirmed to local media outlets that its network was hacked after the ALPHV ransomware gang began leaking data they claim was stolen from the company.
- Bill Toulas
- June 09, 2023
- 11:11 AM
- 1
The Week in Ransomware - June 2nd 2023 - Whodunit?

It has been a fairly quiet week regarding ransomware, with only a few reports released and no new significant attacks. However, we may have a rebrand in the making, and a ransomware operation is likely behind a new zero-day data-theft campaign, so we have some news to talk about.
- Lawrence Abrams
- June 02, 2023
- 05:47 PM
- 0
The Week in Ransomware - May 26th 2023 - Cities Under Attack

Ransomware gangs continue to hammer local governments in attacks, taking down IT systems and disrupting cities' online services.
- Lawrence Abrams
- May 26, 2023
- 04:45 PM
- 2
Malicious Windows kernel drivers used in BlackCat ransomware attacks

The ALPHV ransomware group (aka BlackCat) was observed employing signed malicious Windows kernel drivers to evade detection by security software during attacks.
- Bill Toulas
- May 22, 2023
- 02:23 PM
- 0
Western Digital says hackers stole customer data in March cyberattack

Western Digital has taken its store offline and sent customers data breach notifications after confirming that hackers stole sensitive personal information in a March cyberattack.
- Lawrence Abrams
- May 07, 2023
- 12:10 PM
- 2