Article
ALPHV/BlackCat Disruption: Operations Resume
Cyber Threats
Combating Ransomware
Threat Actors
Despite law enforcement’s disruption to ALPHV/BlackCat’s infrastructure in December 2023, the group has since resumed operations. As Arete previously reported, the Federal Bureau of Investigation (FBI) seized the ransomware group’s data leak site (DLS) on December 19, 2023, and obtained victim-specific decryption keys for over 500 ALPHV victims. Before this, the TOR chat sites used to communicate with victims also went offline in early December, causing some affiliates to resort to alternative means of communication, such as Tox chats and email correspondence, to continue efforts to extort money from their victims.
Interestingly, in January 2023 when the FBI infiltrated Hive ransomware’s operations, they gained access to the group’s servers and decryption keys and successfully shut down Hive’s data leak site, negotiation site, and web panels. This ultimately forced the group to cease operating under the Hive brand after the takedown. It remains to be seen whether ALPHV will suffer a similar fate.
What has happened from December 2023 through January 2024?
Unlike the Hive breach, the impact of this recent law enforcement operation against ALPHV seems to have only temporarily disrupted their infrastructure. Arete observed that the group is resuming normal operations.
After the FBI posted a notice on ALPHV’s data leak site stating it had been seized, the ransomware group briefly regained control of the URL and posted that the site had been “unseized.” The group reportedly retained access to the keys used to operate the DLS and used that access to point visitors to a new DLS that appears fully controlled by ALPHV. ALPHV claimed that the FBI only impacted a portion of its operations.
ALPHV began circulating a new URL for their data leak site shortly after the FBI seizure and has posted new victims since December 13, 2023. Although most of the victim content before law enforcement’s action is no longer on their dark web page, the group has continued to add to the new leak site, with over 20 victims posted as of January 16, 2024. The number of victims on the site continues to fluctuate as ALPHV negotiates with victims.
In response to the actions of law enforcement, the group posted new rules, allowing affiliates to target any organization outside of the Commonwealth of Independent States (CIS), including hospitals and critical infrastructure. The new rules also stated that discounts on ransom demands would no longer be given.
Figure 1 Image of Updated ALPHV rules. Image Source
Since the FBI announcement, Arete observed ALPHV continuing standard ransom communications with its victims contrary to their claims to have changed the rules for affiliates. In late December, the group began using their private TOR chats again to communicate with victims. The new ransom notes include language and naming conventions different from the ones sent to victims before the law enforcement operation. However, the private TOR chats remain the same, displaying a timer and listing a discount price and full price, along with Bitcoin and Monero wallets showing an additional 15% added if payment is in Bitcoin.
Image of ALPHV’s New Data Leak Site
Arete’s Observations
Although the FBI’s operations against ALPHV in December 2023 caused noticeable disruptions to the ransomware group’s ability to operate, law enforcement appeared unable to permanently shut down ALPHV’s infrastructure or operational capabilities, unlike prior law enforcement actions against groups like Hive or REvil. ALPHV appears to be trying to resume its activities in the same manner as before the disruption, reestablishing its data leak site and communicating with new victims on the group’s private TOR sites.
The group’s threats and newly imposed rules appear aimed at projecting strength in the face of the FBI breach rather than representing authentic internal policy changes that affiliates genuinely comply with. Since ALPHV made its public statement in December, Arete observed the group continuing to conduct extortion communications as they did before the disruption, with affiliates still offering discounted prices and showing a willingness to negotiate. While it is too soon to know if there will be a corresponding uptick in attacks against hospitals and critical infrastructure, Arete assesses this would be counterproductive if the group intends to continue operating under the ALPHV/BlackCat brand. The group was already known for attacking the healthcare industry, and future attacks against high-profile targets would lead to even greater attention from law enforcement.
Although ALPHV has been trying to salvage its reputation and resume operations, it is too early to assess whether the group will be able to continue operating as it did prior to law enforcement’s intervention. The knowledge that law enforcement is actively targeting ALPHV will likely deter some affiliates from continuing to work with the group, potentially leading some affiliates to accept active recruitment offers from other Ransomware-as-a-Service (RaaS) groups like LockBit. Even as ALPHV continues to operate, the group may eventually rebrand itself under a different name to complicate further action by law enforcement.
Sources
Back to Blog Posts
Article
Arete's 2026 Q1 Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.
Article
CMS Vulnerability Leads to ClickFix Campaign
Threat actors compromised at least 700 education and technology websites in a recent ClickFix campaign by exploiting a critical SQL injection flaw (CVE-2026-26980) in the Ghost content management system (CMS). Adversaries combined the vulnerability with the ClickFix social engineering tactic to steal admin keys and inject a malicious JavaScript that delivers a fake Cloudflare or CAPTCHA verification pop-up, tricking victims into copying and pasting a malicious command into their systems.
What’s Notable and Unique
Rather than targeting the end user first, this campaign is unique in its initial exploitation of the system, followed by social engineering attempts. This hybrid attack style is likely being leveraged to bypass traditional defenses.
This recent campaign also highlights how trusted web properties can be weaponized at scale and coupled with unpatched CMS vulnerabilities. Rather than using the CMS compromise to perpetrate a single attack, threat actors turned it into a supply-chain attack that ultimately affected over 700 trusted websites.
Analyst Comments
As network defenders and their tools enhance threat detection capabilities, adversaries increasingly seek methods to bypass these defenses. By combining vulnerability exploitation, social engineering techniques, and staging for ancillary attacks, this campaign successfully bypassed traditional defenses and inflicted significant impact. Defending against hybrid cyberattacks requires comprehensive security controls beyond simply patching vulnerabilities. Organizations should focus on limiting movement within the environment, detecting abuse of trusted applications, and preventing end-user manipulation.
Sources
700+ education and tech websites hijacked in huge ClickFix malware campaign
Under the engineering hood: Why Malwarebytes chose WordPress as its CMS
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware
Article
Threat Actors Leverage Fake JPEG Files for Initial Access
In a recent campaign, researchers observed threat actors using fake JPEG image files as a delivery mechanism to initiate the deployment of additional malicious components. The false JPEG files are typically distributed via phishing emails or other social engineering-based lures, and are actually PowerShell-based malware that deploys a trojanized version of ConnectWise ScreenConnect to establish and maintain persistence in the compromised environment.
What’s Notable and Unique
This campaign leverages JPEG images as the initial lure, where the images are not merely decoys but part of the infection workflow. Victims are typically led to download or open an image that triggers hidden execution logic or redirects them to a payload-delivery sequence that initiates later stages of the intrusion chain.
The attack chain is designed to blend into legitimate environments, making detection more difficult. Execution typically relies on scripted or native Windows components, often including PowerShell or other living-off-the-land binaries, enabling fileless or near-fileless execution and reducing forensic artifacts on disk.
The multistage design ensures that the initial JPEG does not directly contain the full payload but instead triggers retrieval or decryption steps that progressively assemble the final malicious components in memory.
Analyst Comments
This campaign illustrates how threat actors continue to blur the line between legitimate file handling and malicious execution chains, indicating potential overlap with remote management or administrative tooling. The use of JPEG-based staging combined with script-based execution reflects a broader evolution toward a stealth-first intrusion design, in which file formats serve as triggers rather than payload containers.
Sources
OPERATION SILENTCANVAS : JPEG BASED MULTISTAGE POWERSHELL INTRUSION
Podcast
Cyber Risk and Insurance for Law Firms
In this episode of Bytes of Insight, host Vinny Sakore is joined by Laura Zaroski, Managing Director of the Law Firms Group at Gallagher, as they discuss the evolution of cyber risk for law firms. Tune in for firsthand insights on how to select the right cyber policy, the incident response process, and the nuances of ransom payments and sensitive data.