Article
Law Enforcement Actions Leave ALPHV/BlackCat Scrambling to Salvage Operations
Cyber Threats
Threat Actors
Combating Ransomware
Through a coordinated law enforcement effort spearheaded by the FBI, ALPHV/BlackCat infrastructure was disrupted on December 7, 2023, in an operation publicly announced on December 19, 2023. After terrorizing businesses and organizations for over two years, the notorious ransomware group may have finally met its match.
What happened to BlackCat’s Infrastructure?
On December 7, 2023, the data leak website for ALPHV/BlackCat went offline and remained offline for more than 30 hours. This is one of the most prolonged disruptions the group has faced, as it previously only experienced periodic outages due to technical hosting issues. The BlackCat data leak site came back online with all data from previous victims removed before apparently being taken down for good on December 19, 2023, when existing BlackCat branding was replaced by an FBI banner including a TOR-based tip line for information on BlackCat and its affiliates.
Figure 1: Law Enforcement Seizure Banner Displayed on Known ALPHV/BlackCat Data Leak Sites on December 19, 2023
The BlackCat Decryptor
Prior to the takedown of BlackCat’s infrastructure, law enforcement maintained access to the threat actor’s environment for months and was able to obtain victim-specific decryption keys to BlackCat’s ransomware executable by monitoring the environment. The FBI used these decryption keys to offer decryption to 500 BlackCat victims as the FBI neared publicizing the takedown. The FBI estimated they were able to save organizations a total of $68 million in ransom demands.
However, based on Arete data, this is likely a conservative number. With an average initial ransom demand of $2.28 million in 2023, BlackCat demands observed by Arete are significantly higher than the demands calculated by law enforcement. While ransom payments are often significantly discounted from the original $2.28 million demand following a negotiation process, it is possible that this action taken by law enforcement could have saved victim organizations as much as five times as what was assessed by the FBI. Alternatively, the gap between Arete and the FBI’s estimated ransom payments may indicate how many organizations had either already paid a ransom before the decryption keys were available or were able to recover without paying the ransom.
The After-Action Report
While the initial data leak site (DLS) disruption nearly two weeks ago caused BlackCat’s operations to decrease significantly, three new victims were posted to the DLS between when the site came back online and when it was finally seized by the FBI. In one of those postings, BlackCat claimed to have reported a new victim to the Securities and Exchange Commission (SEC). In the intervening period, Arete also responded to a BlackCat engagement in which the threat actors utilized an old BlackCat encryptor. Therefore, while the infrastructure takedown certainly disrupted the scale and speed of BlackCat operations, it did not stop the operations of all affiliates.
Shortly after the FBI announced the website seizure on December 19, 2023, ALPHV/BlackCat’s operators stood up a new data leak site and claimed their website was “unseized.” Security researchers assess that BlackCat operators maintained access to the keys used to sign the original data leak site but lost access to their original servers. After standing up the new data leak site, BlackCat made a new post about a victim and stated they will no longer give victims additional time to conduct negotiations. The operators also stated they will harass executive teams and their children, report companies to the SEC and US Department of Health and Human Services (HHS), and release a clearnet (regular internet) link to data on victims.
Figure 2 ALPHV/BlackCat Post Excerpt Uploaded December 19, 2023
With a lack of trust in their own infrastructure, BlackCat affiliates began communicating with victims directly via email rather than relying on typical communication methods. While attempting to continue operations to the best of their ability, BlackCat operators reportedly later discovered that law enforcement gained access to a compromised domain controller and issued a concerning statement to their affiliates, giving them permission to “take the gloves off” in future operations.
The statement shared that all previously observed rules, minus the inability to target CIS* countries, no longer apply to BlackCat affiliates, and an increased percentage of ransom payments, now 90%, will go to affiliates. Additionally, several targets that were reportedly previously forbidden, such as hospitals and nuclear power plants, are now fair game for affiliates to target with the BlackCat encryptor. Finally, BlackCat stated they will no longer accept discounts from the original ransom demand. With an average negotiated discount of 63% off the original ransom demand observed by Arete, the inability to negotiate could cost BlackCat victims millions of dollars if they choose to make ransom payments.
Who is ALPHV/BlackCat?
ALPHV/BlackCat is a ransomware-as-a-service (RaaS) group that first emerged in November 2021. The group operates by providing ransomware software and infrastructure to other cybercriminals, who then use it to launch attacks on various targets. The group takes a cut of the ransom payments and leaks the stolen data of its victims on its Dark Web site. The group is also known for its unique extortion methods, which include reporting its victims to the SEC and creating false domains to impersonate victims and leak data.
Since its inception, ALPHV/BlackCat listed over 650 companies on its data leak site, making it one of the most prolific and dangerous ransomware groups active today. Throughout 2023, BlackCat was the most frequently observed ransomware group in Arete’s industry data. Among 56 different ransomware and extortion groups observed in 2023, BlackCat accounted for nearly a quarter of Arete’s overall engagements.
Figure 3: Visual from Arete’s Q3 2023 Crimeware Report
Affiliates of ALPHV/BlackCat include Scattered Spider, the ransomware group behind the brazen cyberattacks against MGM Resorts, Caesars, and more. The FBI and CISA issued a joint advisory about Scattered Spider in November 2023, warning of their use of ALPHV/BlackCat ransomware.
What are the implications of this takedown?
While the full implications of this takedown are currently unknown, it could have significant implications for the ransomware landscape. The takedown may disrupt the activities of many affiliates relying on ALPHV/BlackCat’s ransomware encryptor and infrastructure, likely forcing existing affiliates to move on to other ransomware programs or develop their own. Notably, LockBit ransomware quickly seized the opportunity to advertise that BlackCat affiliates could continue their current operations under LockBit’s RaaS operation. Additionally, this could lead to the emergence of new ransomware variants and groups, with affiliates bringing experience from previous programs. This happened before when law enforcement actions against other ransomware groups, such as DarkSide and REvil, resulted in the formation of new groups, like BlackMatter and Haron. Even before the FBI takedown, Arete observed a splintering of BlackCat affiliates, with groups like Scattered Spider conducting solo operations alongside operations using the BlackCat encryptor.
While the takedown of ALPHV/BlackCat’s websites is a positive development in the fight against ransomware, it is not a definitive victory. Ransomware remains a persistent and evolving threat that requires constant vigilance and collaboration from all stakeholders, including governments, businesses, and individuals.
BlackCat has been a widely impactful ransomware group, in part because it relied on affiliates with diverse means of compromising victims. Arete observed a wide variety of initial access measures in engagements involving ALPHV/BlackCat affiliates, including a sophisticated capability to exploit software and hardware vulnerabilities. Preventing BlackCat attacks and future ransomware attacks from affiliates that escape law enforcement requires a strong patch management program that prioritizes vulnerabilities with publicly released exploit code. Additionally, managing remote management tools in an environment is critical in preventing similar attacks. Arete identified third-party remote access tools as the initial intrusion method in more than eight percent of ALPHV/BlackCat engagements, but analysis of the full lifecycle of an ALPHV/BlackCat engagement showed those tools being used throughout the attacks to enable attacker operations. Neither method is unique to BlackCat operators and remains an important focus for defenders.
Footnotes
*The Commonwealth of Independent States (CIS) is a regional intergovernmental organization formed following the dissolution of the Soviet Union, including Russia, Belarus, Kazakhstan, Moldova, Armenia, Tajikistan, Uzbekistan, Kyrgyzstan, Azerbaijan, and Turkmenistan.
Sources
Back to Blog Posts
Article
Europol Disrupts AudiA6 Crypto Laundering Service
European authorities have dismantled AudiA6, a major cryptocurrency laundering service linked to ransomware groups and broader cybercriminal networks. Between 2022 and 2025, the platform is believed to have processed over €336 million in illicit funds, enabling threat actors to obscure financial trails and monetize cybercrime proceeds. Its operators are also suspected of running Dark2Web, a dark web forum that facilitated collaboration, services, and connections among cybercriminals globally. This development underscores the expanding role of sophisticated, large-scale cryptocurrency laundering services in sustaining the cybercrime economy, enabling threat actors to obscure illicit funds and evade regulatory controls.
What’s Notable and Unique
Following law enforcement disruption of Cryptex and Garantex, AudiA6 emerged as another platform involved in financial activities linked to ransomware groups. Investigators believe that AudiA6 became a central hub for cybercriminals seeking to launder stolen digital assets while obscuring the transaction trail from authorities.
On June 10, 2026, a coordinated operation resulted in two arrests in Georgia, the dismantling of key infrastructure (30+ servers, 25 domains), the freezing or seizure of over €778,000 in crypto, and the takedown of the AudiA6 and Dark2Web platforms.
Analyst Comments
Ransomware groups and cybercriminal networks are increasingly leveraging sophisticated techniques, including chain-hopping, decentralized exchanges, and mixer-as-a-service platforms, to rapidly move illicit cryptocurrency across multiple blockchains, effectively obscuring transaction trails. Concurrently, the widespread use of fraudulent exchange accounts, mule wallets, and privacy-enhancing tools has elevated cryptocurrency laundering to a core enabler of the cybercrime ecosystem, allowing actors to bypass anti-money-laundering controls at scale. This investigation identified over 6,000 KYC records linked to money-mule accounts, many of which were tied to Russian-speaking intermediaries specifically recruited to facilitate the movement of illicit proceeds. These threat actors systematically used both commercial and domain-controlled email services to establish mule accounts across multiple cryptocurrency platforms. Collectively, these findings underscore the growing scale, coordination, and professionalization of cryptocurrency-enabled crime, highlighting the critical need for sustained, intelligence-led, and internationally coordinated efforts to disrupt these evolving financial ecosystems.
Sources
Ransomware gangs cut off from EUR 336 million ‘AudiA6’ crypto laundering pipeline
Article
Threat Actors Leverage AI for EDR Evasion
A threat actor has developed and deployed a ransomware attack toolkit enhanced with AI-assisted development workflows, enabling automated Active Directory (AD) discovery and improved EDR evasion capabilities. The toolkit leverages agent-based AI systems, such as Claude’s Opus and Cursor agents, for iterative malware development, testing, and refinement.
What’s Notable and Unique
Researchers have highlighted that this toolkit can not only generate ransomware code but also bypass sophisticated security defenses and identify AD networks for malware distribution.
The framework incorporates multiple capabilities, including automated AD discovery and reconnaissance mechanisms, iterative EDR testing environments to refine evasion techniques, and a command-and-control (C2) infrastructure that leverages Telegram APIs and Cloudflare redirectors for stealth.
Additionally, some agents were tasked with checking security research and technical posts for various bypass techniques. The agents recognized what was required for reproduction, extracted the techniques, mapped them to the MITRE ATT&CK knowledge base of adversary behaviors, set up a test lab, carried out the methodology, and reported the results.
After a few repetitions, the modules seemed to avoid nearly all EDR solutions, despite the agent’s initial suggestion of a high failure rate. Although researchers found no evidence that AI was embedded in deployed malware or was operating independently in victim environments, the technology was still used to accelerate the iterative process of developing, testing, and refining payloads against security products, shortening the period between the publication of offensive security research and its practical implementation by threat actors.
Analyst Comments
AI-driven tools like this could accelerate the pace and sophistication of ransomware attacks, enabling even relatively inexperienced actors to launch high-impact campaigns. This development underscores the urgent need for security solutions to adapt to AI-assisted threats. Organizations must respond by strengthening detection engineering, improving visibility across environments, and maintaining robust security fundamentals.
Sources
AI-built ransomware toolkit automates EDR evasion, AD discovery
Pointing a Cursor at evading detection
Article
Arete's 2026 Q1 Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.
Article
CMS Vulnerability Leads to ClickFix Campaign
Threat actors compromised at least 700 education and technology websites in a recent ClickFix campaign by exploiting a critical SQL injection flaw (CVE-2026-26980) in the Ghost content management system (CMS). Adversaries combined the vulnerability with the ClickFix social engineering tactic to steal admin keys and inject a malicious JavaScript that delivers a fake Cloudflare or CAPTCHA verification pop-up, tricking victims into copying and pasting a malicious command into their systems.
What’s Notable and Unique
Rather than targeting the end user first, this campaign is unique in its initial exploitation of the system, followed by social engineering attempts. This hybrid attack style is likely being leveraged to bypass traditional defenses.
This recent campaign also highlights how trusted web properties can be weaponized at scale and coupled with unpatched CMS vulnerabilities. Rather than using the CMS compromise to perpetrate a single attack, threat actors turned it into a supply-chain attack that ultimately affected over 700 trusted websites.
Analyst Comments
As network defenders and their tools enhance threat detection capabilities, adversaries increasingly seek methods to bypass these defenses. By combining vulnerability exploitation, social engineering techniques, and staging for ancillary attacks, this campaign successfully bypassed traditional defenses and inflicted significant impact. Defending against hybrid cyberattacks requires comprehensive security controls beyond simply patching vulnerabilities. Organizations should focus on limiting movement within the environment, detecting abuse of trusted applications, and preventing end-user manipulation.
Sources
700+ education and tech websites hijacked in huge ClickFix malware campaign
Under the engineering hood: Why Malwarebytes chose WordPress as its CMS
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware