Article
ALPHV/BlackCat Disruption: Operations Resume
Cyber Threats
Combating Ransomware
Threat Actors
Despite law enforcement’s disruption to ALPHV/BlackCat’s infrastructure in December 2023, the group has since resumed operations. As Arete previously reported, the Federal Bureau of Investigation (FBI) seized the ransomware group’s data leak site (DLS) on December 19, 2023, and obtained victim-specific decryption keys for over 500 ALPHV victims. Before this, the TOR chat sites used to communicate with victims also went offline in early December, causing some affiliates to resort to alternative means of communication, such as Tox chats and email correspondence, to continue efforts to extort money from their victims.
Interestingly, in January 2023 when the FBI infiltrated Hive ransomware’s operations, they gained access to the group’s servers and decryption keys and successfully shut down Hive’s data leak site, negotiation site, and web panels. This ultimately forced the group to cease operating under the Hive brand after the takedown. It remains to be seen whether ALPHV will suffer a similar fate.
What has happened from December 2023 through January 2024?
Unlike the Hive breach, the impact of this recent law enforcement operation against ALPHV seems to have only temporarily disrupted their infrastructure. Arete observed that the group is resuming normal operations.
After the FBI posted a notice on ALPHV’s data leak site stating it had been seized, the ransomware group briefly regained control of the URL and posted that the site had been “unseized.” The group reportedly retained access to the keys used to operate the DLS and used that access to point visitors to a new DLS that appears fully controlled by ALPHV. ALPHV claimed that the FBI only impacted a portion of its operations.
ALPHV began circulating a new URL for their data leak site shortly after the FBI seizure and has posted new victims since December 13, 2023. Although most of the victim content before law enforcement’s action is no longer on their dark web page, the group has continued to add to the new leak site, with over 20 victims posted as of January 16, 2024. The number of victims on the site continues to fluctuate as ALPHV negotiates with victims.
In response to the actions of law enforcement, the group posted new rules, allowing affiliates to target any organization outside of the Commonwealth of Independent States (CIS), including hospitals and critical infrastructure. The new rules also stated that discounts on ransom demands would no longer be given.
Figure 1 Image of Updated ALPHV rules. Image Source
Since the FBI announcement, Arete observed ALPHV continuing standard ransom communications with its victims contrary to their claims to have changed the rules for affiliates. In late December, the group began using their private TOR chats again to communicate with victims. The new ransom notes include language and naming conventions different from the ones sent to victims before the law enforcement operation. However, the private TOR chats remain the same, displaying a timer and listing a discount price and full price, along with Bitcoin and Monero wallets showing an additional 15% added if payment is in Bitcoin.
Image of ALPHV’s New Data Leak Site
Arete’s Observations
Although the FBI’s operations against ALPHV in December 2023 caused noticeable disruptions to the ransomware group’s ability to operate, law enforcement appeared unable to permanently shut down ALPHV’s infrastructure or operational capabilities, unlike prior law enforcement actions against groups like Hive or REvil. ALPHV appears to be trying to resume its activities in the same manner as before the disruption, reestablishing its data leak site and communicating with new victims on the group’s private TOR sites.
The group’s threats and newly imposed rules appear aimed at projecting strength in the face of the FBI breach rather than representing authentic internal policy changes that affiliates genuinely comply with. Since ALPHV made its public statement in December, Arete observed the group continuing to conduct extortion communications as they did before the disruption, with affiliates still offering discounted prices and showing a willingness to negotiate. While it is too soon to know if there will be a corresponding uptick in attacks against hospitals and critical infrastructure, Arete assesses this would be counterproductive if the group intends to continue operating under the ALPHV/BlackCat brand. The group was already known for attacking the healthcare industry, and future attacks against high-profile targets would lead to even greater attention from law enforcement.
Although ALPHV has been trying to salvage its reputation and resume operations, it is too early to assess whether the group will be able to continue operating as it did prior to law enforcement’s intervention. The knowledge that law enforcement is actively targeting ALPHV will likely deter some affiliates from continuing to work with the group, potentially leading some affiliates to accept active recruitment offers from other Ransomware-as-a-Service (RaaS) groups like LockBit. Even as ALPHV continues to operate, the group may eventually rebrand itself under a different name to complicate further action by law enforcement.
Sources
Back to Blog Posts
Podcast
Blockchain Unmasked: The Role of Cryptocurrency in Cybercrime and Threat Intelligence
In this episode of Bytes of Insight, host Vinny Sakore sits down with John Morrissey, Arete’s Director of Cryptocurrency Operations and Sanctions Compliance, and Trenton Howard, Arete’s Lead Threat Intelligence Consultant, to discuss cryptocurrency and blockchain technology. They explore the impact of cryptocurrency on both innovation and cybercrime, threat actors’ use of the blockchain for ransom payments, and Arete’s patent-pending Compliance and Sanctions Analysis Process.
Article
ClickFix Evolves in Server-Side Polymorphic Malware Delivery Campaigns
The ClickFix social engineering technique has significantly evolved from a relatively simple malware delivery mechanism into a highly sophisticated, evasive attack framework. Initially relying on straightforward PowerShell downloaders and disk-based payloads, the campaign now employs fileless execution, advanced obfuscation techniques, and server-side polymorphism to evade traditional security controls.
What’s Notable and Unique
ClickFix primarily relies on social engineering, as victims are presented with fake CAPTCHA verification pages that imitate trusted services such as Cloudflare or Google reCAPTCHA. Users are instructed to copy and execute a PowerShell command, believing they are completing a legitimate verification process. Instead, the command initiates the malware infection chain.
To bypass traditional security tools, threat actors transitioned to fileless techniques. Instead of downloading scripts directly to disk, newer variants execute malicious code entirely in memory. The most notable recent advancement in ClickFix is the adoption of server-side polymorphism. Unlike traditional malware that delivers a static payload, the threat actor's server dynamically generates unique payloads for each victim request. This approach undermines signature-based detection methods because each delivered payload appears unique, preventing defenders from relying solely on file hashes or static indicators.
The campaign was observed beginning around March 25, 2026, with a significant increase in activity thereafter, indicating that the techniques are proving effective against many organizations' defenses.
Analyst Comments
ClickFix social engineering campaigns continue to evolve in 2026, becoming more sophisticated and expanding across multiple operating systems. Organizations should focus on behavioral detection, browser isolation, endpoint monitoring, and user awareness training rather than relying solely on indicators such as hashes or blocklists. The campaign's use of fake CAPTCHA prompts also reinforces the importance of educating users never to execute commands from websites.
Sources
The Evolution of ClickFix: From Cleartext to Server Side Polymorphism
Article
Ransomware Trends & Data Insights: July 2026
INC Ransom was the most active threat group in July, while activity remained relatively distributed among multiple threat groups, with 19 unique groups observed throughout the month. Alongside INC Ransom, Qilin, Global Secret Group, Anubis, and DragonForce rounded out the five most active threat groups observed in July. Several emerging threat actors were also observed during the month, including Booba Team, Settra, and Global Secret Group.
Figure 1. Activity from the top 3 threat groups in July 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In July 2026, Global Secret Group emerged as a new threat actor, leveraging the leaked LockBit 3.0 (LockBit Black) source code. Although the group began operations in June 2026, it quickly accumulated a substantial number of victims on its data leak site (DLS). The group operates through TOR-based negotiation portals and qTox communications. Notably, its DLS provides step-by-step guidance on purchasing Bitcoin, including references to Coinbase and Binance, demonstrating a streamlined, victim-focused extortion process designed to simplify ransom payments.
Similar to Fulcrumsec, the recently emerged Settra ransomware group appears to leverage AI-driven analysis of stolen data, publishing detailed and highly structured victim reports on its DLS. Additionally, a potential EDR-disabling tool, edr_blind.exe, was identified in multiple cases, suggesting a focus on defense-evasion capabilities.
With the continuation of the FortiBleed campaign, researchers have now identified compromised FortiGate credentials being leveraged by both the INC and Lynx ransomware operations. Analysis revealed direct operational links between the groups, including shared ransomware infrastructure and overlap between FortiBleed victims and ransomware targets. The operators are also incorporating AI to enhance various stages of the attack lifecycle and increase operational efficiency and scale. Notably, Arete also observed an INC ransomware intrusion leveraging FortiBleed-derived access in July, reinforcing the campaign's role as a precursor to ransomware deployment.
Sources
Arete Internal
Podcast
Cyber Campfire: June Threat Trends & Insights
In this episode of Arete’s Cyber Campfire podcast, our Threat Intelligence Team discusses trends, statistics, and emerging threat actors from June 2026. Tune in for firsthand insights on today’s threat landscape that can enhance your approach to cyber risk.