ALPHV/BlackCat Disruption: Operations Resume

Despite law enforcement’s disruption to ALPHV/BlackCat’s infrastructure in December 2023, the group has since resumed operations. As Arete previously reported, the Federal Bureau of Investigation (FBI) seized the ransomware group’s data leak site (DLS) on December 19, 2023, and obtained victim-specific decryption keys for over 500 ALPHV victims. Before this, the TOR chat sites used to communicate with victims also went offline in early December, causing some affiliates to resort to alternative means of communication, such as Tox chats and email correspondence, to continue efforts to extort money from their victims.

Interestingly, in January 2023 when the FBI infiltrated Hive ransomware’s operations, they gained access to the group’s servers and decryption keys and successfully shut down Hive’s data leak site, negotiation site, and web panels. This ultimately forced the group to cease operating under the Hive brand after the takedown. It remains to be seen whether ALPHV will suffer a similar fate.

What has happened from December 2023 through January 2024?

Unlike the Hive breach, the impact of this recent law enforcement operation against ALPHV seems to have only temporarily disrupted their infrastructure. Arete observed that the group is resuming normal operations.

• After the FBI posted a notice on ALPHV’s data leak site stating it had been seized, the ransomware group briefly regained control of the URL and posted that the site had been “unseized.” The group reportedly retained access to the keys used to operate the DLS and used that access to point visitors to a new DLS that appears fully controlled by ALPHV. ALPHV claimed that the FBI only impacted a portion of its operations.
• ALPHV began circulating a new URL for their data leak site shortly after the FBI seizure and has posted new victims since December 13, 2023. Although most of the victim content before law enforcement’s action is no longer on their dark web page, the group has continued to add to the new leak site, with over 20 victims posted as of January 16, 2024. The number of victims on the site continues to fluctuate as ALPHV negotiates with victims.
• In response to the actions of law enforcement, the group posted new rules, allowing affiliates to target any organization outside of the Commonwealth of Independent States (CIS), including hospitals and critical infrastructure. The new rules also stated that discounts on ransom demands would no longer be given.

• Since the FBI announcement, Arete observed ALPHV continuing standard ransom communications with its victims contrary to their claims to have changed the rules for affiliates. In late December, the group began using their private TOR chats again to communicate with victims. The new ransom notes include language and naming conventions different from the ones sent to victims before the law enforcement operation. However, the private TOR chats remain the same, displaying a timer and listing a discount price and full price, along with Bitcoin and Monero wallets showing an additional 15% added if payment is in Bitcoin.

Arete’s Observations

Although the FBI’s operations against ALPHV in December 2023 caused noticeable disruptions to the ransomware group’s ability to operate, law enforcement appeared unable to permanently shut down ALPHV’s infrastructure or operational capabilities, unlike prior law enforcement actions against groups like Hive or REvil. ALPHV appears to be trying to resume its activities in the same manner as before the disruption, reestablishing its data leak site and communicating with new victims on the group’s private TOR sites.

The group’s threats and newly imposed rules appear aimed at projecting strength in the face of the FBI breach rather than representing authentic internal policy changes that affiliates genuinely comply with. Since ALPHV made its public statement in December, Arete observed the group continuing to conduct extortion communications as they did before the disruption, with affiliates still offering discounted prices and showing a willingness to negotiate. While it is too soon to know if there will be a corresponding uptick in attacks against hospitals and critical infrastructure, Arete assesses this would be counterproductive if the group intends to continue operating under the ALPHV/BlackCat brand. The group was already known for attacking the healthcare industry, and future attacks against high-profile targets would lead to even greater attention from law enforcement.

Although ALPHV has been trying to salvage its reputation and resume operations, it is too early to assess whether the group will be able to continue operating as it did prior to law enforcement’s intervention. The knowledge that law enforcement is actively targeting ALPHV will likely deter some affiliates from continuing to work with the group, potentially leading some affiliates to accept active recruitment offers from other Ransomware-as-a-Service (RaaS) groups like LockBit. Even as ALPHV continues to operate, the group may eventually rebrand itself under a different name to complicate further action by law enforcement.

Sources

• https://www.bleepingcomputer.com/news/security/how-the-fbi-seized-blackcat-alphv-ransomwares-servers/
• https://krebsonsecurity.com/2023/12/blackcat-ransomware-raises-ante-after-fbi-disruption/
• https://www.bleepingcomputer.com/news/security/hive-ransomware-disrupted-after-fbi-hacks-gangs-systems/ 
• https://www.darkreading.com/cyberattacks-data-breaches/hunters-international-cyberattackers-take-over-hive-ransomware
• https://thehackernews.com/2023/12/fbi-takes-down-blackcat-ransomware.html