Article
Law Enforcement Actions Leave ALPHV/BlackCat Scrambling to Salvage Operations
Cyber Threats
Threat Actors
Combating Ransomware
Through a coordinated law enforcement effort spearheaded by the FBI, ALPHV/BlackCat infrastructure was disrupted on December 7, 2023, in an operation publicly announced on December 19, 2023. After terrorizing businesses and organizations for over two years, the notorious ransomware group may have finally met its match.
What happened to BlackCat’s Infrastructure?
On December 7, 2023, the data leak website for ALPHV/BlackCat went offline and remained offline for more than 30 hours. This is one of the most prolonged disruptions the group has faced, as it previously only experienced periodic outages due to technical hosting issues. The BlackCat data leak site came back online with all data from previous victims removed before apparently being taken down for good on December 19, 2023, when existing BlackCat branding was replaced by an FBI banner including a TOR-based tip line for information on BlackCat and its affiliates.
Figure 1: Law Enforcement Seizure Banner Displayed on Known ALPHV/BlackCat Data Leak Sites on December 19, 2023
The BlackCat Decryptor
Prior to the takedown of BlackCat’s infrastructure, law enforcement maintained access to the threat actor’s environment for months and was able to obtain victim-specific decryption keys to BlackCat’s ransomware executable by monitoring the environment. The FBI used these decryption keys to offer decryption to 500 BlackCat victims as the FBI neared publicizing the takedown. The FBI estimated they were able to save organizations a total of $68 million in ransom demands.
However, based on Arete data, this is likely a conservative number. With an average initial ransom demand of $2.28 million in 2023, BlackCat demands observed by Arete are significantly higher than the demands calculated by law enforcement. While ransom payments are often significantly discounted from the original $2.28 million demand following a negotiation process, it is possible that this action taken by law enforcement could have saved victim organizations as much as five times as what was assessed by the FBI. Alternatively, the gap between Arete and the FBI’s estimated ransom payments may indicate how many organizations had either already paid a ransom before the decryption keys were available or were able to recover without paying the ransom.
The After-Action Report
While the initial data leak site (DLS) disruption nearly two weeks ago caused BlackCat’s operations to decrease significantly, three new victims were posted to the DLS between when the site came back online and when it was finally seized by the FBI. In one of those postings, BlackCat claimed to have reported a new victim to the Securities and Exchange Commission (SEC). In the intervening period, Arete also responded to a BlackCat engagement in which the threat actors utilized an old BlackCat encryptor. Therefore, while the infrastructure takedown certainly disrupted the scale and speed of BlackCat operations, it did not stop the operations of all affiliates.
Shortly after the FBI announced the website seizure on December 19, 2023, ALPHV/BlackCat’s operators stood up a new data leak site and claimed their website was “unseized.” Security researchers assess that BlackCat operators maintained access to the keys used to sign the original data leak site but lost access to their original servers. After standing up the new data leak site, BlackCat made a new post about a victim and stated they will no longer give victims additional time to conduct negotiations. The operators also stated they will harass executive teams and their children, report companies to the SEC and US Department of Health and Human Services (HHS), and release a clearnet (regular internet) link to data on victims.
Figure 2 ALPHV/BlackCat Post Excerpt Uploaded December 19, 2023
With a lack of trust in their own infrastructure, BlackCat affiliates began communicating with victims directly via email rather than relying on typical communication methods. While attempting to continue operations to the best of their ability, BlackCat operators reportedly later discovered that law enforcement gained access to a compromised domain controller and issued a concerning statement to their affiliates, giving them permission to “take the gloves off” in future operations.
The statement shared that all previously observed rules, minus the inability to target CIS* countries, no longer apply to BlackCat affiliates, and an increased percentage of ransom payments, now 90%, will go to affiliates. Additionally, several targets that were reportedly previously forbidden, such as hospitals and nuclear power plants, are now fair game for affiliates to target with the BlackCat encryptor. Finally, BlackCat stated they will no longer accept discounts from the original ransom demand. With an average negotiated discount of 63% off the original ransom demand observed by Arete, the inability to negotiate could cost BlackCat victims millions of dollars if they choose to make ransom payments.
Who is ALPHV/BlackCat?
ALPHV/BlackCat is a ransomware-as-a-service (RaaS) group that first emerged in November 2021. The group operates by providing ransomware software and infrastructure to other cybercriminals, who then use it to launch attacks on various targets. The group takes a cut of the ransom payments and leaks the stolen data of its victims on its Dark Web site. The group is also known for its unique extortion methods, which include reporting its victims to the SEC and creating false domains to impersonate victims and leak data.
Since its inception, ALPHV/BlackCat listed over 650 companies on its data leak site, making it one of the most prolific and dangerous ransomware groups active today. Throughout 2023, BlackCat was the most frequently observed ransomware group in Arete’s industry data. Among 56 different ransomware and extortion groups observed in 2023, BlackCat accounted for nearly a quarter of Arete’s overall engagements.
Figure 3: Visual from Arete’s Q3 2023 Crimeware Report
Affiliates of ALPHV/BlackCat include Scattered Spider, the ransomware group behind the brazen cyberattacks against MGM Resorts, Caesars, and more. The FBI and CISA issued a joint advisory about Scattered Spider in November 2023, warning of their use of ALPHV/BlackCat ransomware.
What are the implications of this takedown?
While the full implications of this takedown are currently unknown, it could have significant implications for the ransomware landscape. The takedown may disrupt the activities of many affiliates relying on ALPHV/BlackCat’s ransomware encryptor and infrastructure, likely forcing existing affiliates to move on to other ransomware programs or develop their own. Notably, LockBit ransomware quickly seized the opportunity to advertise that BlackCat affiliates could continue their current operations under LockBit’s RaaS operation. Additionally, this could lead to the emergence of new ransomware variants and groups, with affiliates bringing experience from previous programs. This happened before when law enforcement actions against other ransomware groups, such as DarkSide and REvil, resulted in the formation of new groups, like BlackMatter and Haron. Even before the FBI takedown, Arete observed a splintering of BlackCat affiliates, with groups like Scattered Spider conducting solo operations alongside operations using the BlackCat encryptor.
While the takedown of ALPHV/BlackCat’s websites is a positive development in the fight against ransomware, it is not a definitive victory. Ransomware remains a persistent and evolving threat that requires constant vigilance and collaboration from all stakeholders, including governments, businesses, and individuals.
BlackCat has been a widely impactful ransomware group, in part because it relied on affiliates with diverse means of compromising victims. Arete observed a wide variety of initial access measures in engagements involving ALPHV/BlackCat affiliates, including a sophisticated capability to exploit software and hardware vulnerabilities. Preventing BlackCat attacks and future ransomware attacks from affiliates that escape law enforcement requires a strong patch management program that prioritizes vulnerabilities with publicly released exploit code. Additionally, managing remote management tools in an environment is critical in preventing similar attacks. Arete identified third-party remote access tools as the initial intrusion method in more than eight percent of ALPHV/BlackCat engagements, but analysis of the full lifecycle of an ALPHV/BlackCat engagement showed those tools being used throughout the attacks to enable attacker operations. Neither method is unique to BlackCat operators and remains an important focus for defenders.
Footnotes
*The Commonwealth of Independent States (CIS) is a regional intergovernmental organization formed following the dissolution of the Soviet Union, including Russia, Belarus, Kazakhstan, Moldova, Armenia, Tajikistan, Uzbekistan, Kyrgyzstan, Azerbaijan, and Turkmenistan.
Sources
Back to Blog Posts
Article
Threat Actors Continue to Leverage BYOVD Technique
Multiple ransomware operations have recently been observed leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Notably, the Qilin ransomware group commonly leverages a malicious msimg32.dll file loaded via DLL side-loading, along with vulnerable drivers including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Similarly, Warlock ransomware has been observed exploiting the vulnerable NSecKrnl.sys driver to bypass security controls. The use of BYOVD has also been observed across ransomware campaigns associated with Akira, INC, Medusa, and other threat actors.
What’s Notable and Unique
The Qilin ransomware group employs a sophisticated multi-stage infection chain, leveraging DLL side-loading (msimg32.dll) to execute malicious payloads directly in memory and evade traditional file-based detection. In DLL side-loading, a threat actor tricks a program into loading a malicious dynamic link library. The malware escalates privileges and uses signed but vulnerable drivers (rwdrv.sys and hlpdrv.sys) to bypass security controls, access system memory, and systematically disable endpoint defenses by terminating security processes and disabling monitoring callbacks at the kernel level.
Akira ransomware operators have also exploited the rwdrv.sys and hlpdrv.sys drivers. Additionally, Arete has observed threat actors leveraging multiple other drivers, including the vulnerable TrueSight.sys, to bypass security controls.
Meanwhile, Warlock ransomware operators disguised malicious activity by renaming rclone.exe to TrendSecurity.exe to appear legitimate. The file functioned as a loader, exploiting the vulnerable NSecKrnl.sys driver to disable security processes, while Group Policy Objects (GPOs) were leveraged to systematically disable security controls across the environment.
Analyst Comments
The BYOVD technique, employed by multiple known ransomware operators, reflects a broader shift toward pre-encryption defense evasion, including suppression of Windows telemetry, removal of monitoring callbacks, and abuse of legitimately signed but vulnerable drivers. This technique enables threat actors to evade detection, maintain persistence for extended periods, and maximize the operational impact of ransomware deployment across compromised environments. Organizations should implement strict driver control policies, such as Microsoft’s Vulnerable Driver Blocklist and application control mechanisms. Additionally, enforcing least privilege access, enabling multi-factor authentication (MFA), maintaining up-to-date patching, and continuously monitoring for anomalous driver and kernel-level activity can further reduce the risk of such attacks.
Sources
Qilin EDR killer infection chain
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
Article
Ransomware Trends & Data Insights: March 2026
The threat landscape in March had a much more even distribution of threat groups than has been observed since the first half of 2025. Although Akira, Qilin, Play, and INC remained among the most active groups, Arete observed 21 unique ransomware and extortion groups in March, compared to only 15 in February. Akira and Qilin’s activity also declined from the previous month; in February, the two groups were responsible for almost half of all ransomware incidents, but in March they only comprised a little more than a quarter of all activity. Arete also observed activity from several emerging groups in the past month, including BravoX, NightSpire, Payouts King, and Securotrop.
Figure 1. Activity from the top 5 threat groups in March 2026
Analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In March, threat actors actively exploited FortiGate Next-Generation Firewall appliances as initial access vectors to compromise enterprise networks. The activity involves the exploitation of recently disclosed security vulnerabilities, including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or weak credentials, allowing attackers to gain administrative access, extract configuration files, and obtain service account credentials. Arete also observed Fortinet device exploitation involving various threat groups, with the Qilin ransomware group notably leveraging Fortinet device exploits.
Phishing campaigns leveraging OAuth redirection and a resurgence of Microsoft Teams–based social engineering were also observed in March. In one campaign, attackers sent emails disguised as Microsoft Teams recordings or Microsoft 365 alerts, redirecting victims through legitimate OAuth endpoints to attacker-controlled pages hosting malicious ZIP payloads. A separate campaign has been ongoing since last year, in which attackers flood users’ inboxes with spam and impersonate IT support personnel to trick victims into initiating remote support sessions via tools like Quick Assist.
Arete recently released its 2025 Annual Crimeware Report. Leveraging data and intelligence collected during ransomware and extortion incident response engagements, this report highlights notable trends and shifts in the threat landscape throughout 2025, including Akira’s unusually high activity levels in the second half of 2025, evolving social engineering techniques, and trends in ransom demands and impacted industries.
Sources
Arete Internal
Report
Arete's 2025 Annual Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.
Article
FortiGate Exploits Enable Network Breaches and Credential Theft
A recent security report indicates that threat actors are actively exploiting FortiGate Next-Generation Firewall (NGFW) appliances as initial access vectors to compromise enterprise networks. The activity leverages recently disclosed vulnerabilities or weak credentials to gain unauthorized access and extract configuration files, which often contain sensitive information, including service account credentials and detailed network topology data.
Analysis of these incidents shows significant variation in attacker dwell time, ranging from immediate lateral movement to delays of up to two months post-compromise. Since these appliances often integrate with authentication systems such as Active Directory and Lightweight Directory Access Protocol (LDAP), their compromise can grant attackers extensive access, substantially increasing the risk of widespread network intrusion and data exposure.
What’s Notable and Unique
The activity involves the exploitation of recently disclosed security vulnerabilities, including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or weak credentials, allowing attackers to gain administrative access, extract configuration files, and obtain service account credentials and network topology information.
In one observed incident, attackers created a FortiGate admin account with unrestricted firewall rules and maintained access over time, consistent with initial access broker activity. After a couple of months, threat actors extracted and decrypted LDAP credentials to compromise Active Directory.
In another case, attackers moved from FortiGate access to deploying remote access tools, including Pulseway and MeshAgent, while also utilizing cloud infrastructure such as Google Cloud Storage and Amazon Web Services (AWS).
Analyst Comments
Arete has identified multiple instances of Fortinet device exploitation for initial access, involving various threat actors, with the Qilin ransomware group notably leveraging Fortinet device exploits. Given their integration with systems like Active Directory, NGFW appliances remain high-value targets for both state-aligned and financially motivated actors. In parallel, Arete has observed recent dark web activity involving leaked FortiGate VPN access, further highlighting the expanding risk landscape. This aligns with the recent reporting from Amazon Threat Intelligence, which identified large-scale compromises of FortiGate devices driven by exposed management ports and weak authentication, rather than vulnerability exploitation. Overall, these developments underscore the increasing focus on network edge devices as entry points, reinforcing the need for organizations to strengthen authentication, restrict external exposure, and address fundamental security gaps to mitigate the risk of widespread compromise.
Sources
FortiGate Edge Intrusions | Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise