ALPHV
Also reported as ALPHVM, BlackCat Gang, UNC4466 and Ambitious Scorpius.
Reports per quarter
Techniques seen in the last two years
- T1486 6 reports
- T1053 4 reports
- T1190 4 reports
- T1490 4 reports
- T1021 3 reports
- T1078 3 reports
- T1078.002 3 reports
- T1083 3 reports
- T1098 3 reports
- T1133 3 reports
Show all 267 techniques Show fewer
- T1219 3 reports
- T1482 3 reports
- T1555 3 reports
- T1566.004 3 reports
- T1567.002 3 reports
- T1572 3 reports
- T1598 3 reports
- T1003 2 reports
- T1012 2 reports
- T1016 2 reports
- T1020 2 reports
- T1021.001 2 reports
- T1021.004 2 reports
- T1040 2 reports
- T1056 2 reports
- T1059 2 reports
- T1059.001 2 reports
- T1059.003 2 reports
- T1059.006 2 reports
- T1070.004 2 reports
- T1072 2 reports
- T1087 2 reports
- T1090 2 reports
- T1105 2 reports
- T1114.002 2 reports
- T1129 2 reports
- T1134 2 reports
- T1135 2 reports
- T1136.001 2 reports
- T1140 2 reports
- T1204 2 reports
- T1204.002 2 reports
- T1212 2 reports
- T1213.002 2 reports
- T1484 2 reports
- T1505 2 reports
- T1505.003 2 reports
- T1528 2 reports
- T1537 2 reports
- T1558 2 reports
- T1566 2 reports
- T1569.002 2 reports
- T1586 2 reports
- T1615 2 reports
- T1657 2 reports
- T0846 1 report
- T1003.003 1 report
- T1005 1 report
- T1007 1 report
- T1008 1 report
- T1010 1 report
- T1014 1 report
- T1016.001 1 report
- T1018 1 report
- T1021.002 1 report
- T1021.005 1 report
- T1021.006 1 report
- T1027 1 report
- T1033 1 report
- T1036 1 report
- T1037 1 report
- T1037.001 1 report
- T1039 1 report
- T1041 1 report
- T1046 1 report
- T1047 1 report
- T1048 1 report
- T1049 1 report
- T1053.003 1 report
- T1053.005 1 report
- T1055 1 report
- T1055.001 1 report
- T1055.002 1 report
- T1055.003 1 report
- T1055.004 1 report
- T1055.009 1 report
- T1055.012 1 report
- T1056.001 1 report
- T1057 1 report
- T1059.002 1 report
- T1059.004 1 report
- T1059.005 1 report
- T1059.007 1 report
- T1059.009 1 report
- T1059.010 1 report
- T1059.011 1 report
- T1068 1 report
- T1069 1 report
- T1069.001 1 report
- T1069.002 1 report
- T1069.003 1 report
- T1070 1 report
- T1071 1 report
- T1071.001 1 report
- T1071.004 1 report
- T1074 1 report
- T1074.001 1 report
- T1074.002 1 report
- T1078.003 1 report
- T1078.004 1 report
- T1082 1 report
- T1087.001 1 report
- T1087.002 1 report
- T1087.004 1 report
- T1090.001 1 report
- T1090.003 1 report
- T1091 1 report
- T1095 1 report
- T1098.001 1 report
- T1098.003 1 report
- T1098.004 1 report
- T1098.005 1 report
- T1098.006 1 report
- T1098.007 1 report
- T1102 1 report
- T1102.002 1 report
- T1104 1 report
- T1106 1 report
- T1112 1 report
- T1113 1 report
- T1114 1 report
- T1114.001 1 report
- T1114.003 1 report
- T1115 1 report
- T1119 1 report
- T1120 1 report
- T1123 1 report
- T1124 1 report
- T1125 1 report
- T1132 1 report
- T1132.001 1 report
- T1134.001 1 report
- T1136 1 report
- T1136.002 1 report
- T1137 1 report
- T1137.006 1 report
- T1189 1 report
- T1195 1 report
- T1195.002 1 report
- T1199 1 report
- T1200 1 report
- T1201 1 report
- T1203 1 report
- T1204.001 1 report
- T1210 1 report
- T1213 1 report
- T1213.001 1 report
- T1213.003 1 report
- T1217 1 report
- T1222 1 report
- T1484.001 1 report
- T1485 1 report
- T1489 1 report
- T1491.002 1 report
- T1496 1 report
- T1497 1 report
- T1497.001 1 report
- T1505.004 1 report
- T1518 1 report
- T1518.001 1 report
- T1526 1 report
- T1529 1 report
- T1530 1 report
- T1534 1 report
- T1538 1 report
- T1542.003 1 report
- T1543 1 report
- T1543.002 1 report
- T1543.003 1 report
- T1543.004 1 report
- T1546 1 report
- T1546.003 1 report
- T1546.004 1 report
- T1546.008 1 report
- T1546.012 1 report
- T1546.015 1 report
- T1547 1 report
- T1547.001 1 report
- T1547.002 1 report
- T1547.005 1 report
- T1547.009 1 report
- T1548 1 report
- T1548.002 1 report
- T1550 1 report
- T1550.001 1 report
- T1550.002 1 report
- T1552 1 report
- T1554 1 report
- T1555.003 1 report
- T1555.005 1 report
- T1556 1 report
- T1556.006 1 report
- T1556.009 1 report
- T1557 1 report
- T1559 1 report
- T1560 1 report
- T1560.001 1 report
- T1560.002 1 report
- T1563.002 1 report
- T1564 1 report
- T1565 1 report
- T1565.001 1 report
- T1566.001 1 report
- T1566.002 1 report
- T1566.003 1 report
- T1567 1 report
- T1567.001 1 report
- T1569 1 report
- T1570 1 report
- T1571 1 report
- T1573 1 report
- T1573.001 1 report
- T1573.002 1 report
- T1574 1 report
- T1574.001 1 report
- T1574.006 1 report
- T1574.011 1 report
- T1578 1 report
- T1580 1 report
- T1583 1 report
- T1583.003 1 report
- T1584 1 report
- T1585 1 report
- T1585.002 1 report
- T1587 1 report
- T1587.001 1 report
- T1587.002 1 report
- T1587.003 1 report
- T1588 1 report
- T1588.003 1 report
- T1588.004 1 report
- T1588.007 1 report
- T1589.002 1 report
- T1590 1 report
- T1592 1 report
- T1593 1 report
- T1595 1 report
- T1595.002 1 report
- T1596 1 report
- T1602 1 report
- T1602.001 1 report
- T1602.002 1 report
- T1608 1 report
- T1608.001 1 report
- T1608.002 1 report
- T1608.003 1 report
- T1608.004 1 report
- T1608.005 1 report
- T1608.006 1 report
- T1613 1 report
- T1614 1 report
- T1614.001 1 report
- T1619 1 report
- T1621 1 report
- T1622 1 report
- T1652 1 report
- T1654 1 report
Counts come from technique IDs in the actor's report text.
CVEs named in reports
- CVE-2008-2463
- CVE-2015-2291 KEV ransomware
- CVE-2016-0099 KEV ransomware
- CVE-2017-0144 KEV ransomware
- CVE-2017-0199 KEV ransomware
- CVE-2017-11882 KEV ransomware
- CVE-2017-5638 KEV ransomware
- CVE-2018-13379 KEV ransomware
- CVE-2019-0604 KEV ransomware
- CVE-2019-0708 KEV ransomware
- CVE-2019-11510 KEV ransomware
- CVE-2019-11634 KEV ransomware
Show all 127 CVEs Show fewer
- CVE-2019-18935 KEV ransomware
- CVE-2019-19781 KEV ransomware
- CVE-2019-5591 KEV ransomware
- CVE-2019-7481 KEV ransomware
- CVE-2020-12271 KEV ransomware
- CVE-2020-12812 KEV ransomware
- CVE-2020-1472 KEV ransomware
- CVE-2020-3529
- CVE-2020-36198
- CVE-2020-5135 KEV ransomware
- CVE-2020-8195 KEV
- CVE-2020-8196 KEV
- CVE-2020-8234
- CVE-2020-8260 KEV
- CVE-2021-20016 KEV ransomware
- CVE-2021-20655
- CVE-2021-21972 KEV ransomware
- CVE-2021-21974
- CVE-2021-2198
- CVE-2021-22893 KEV ransomware
- CVE-2021-22941 KEV ransomware
- CVE-2021-22986 KEV ransomware
- CVE-2021-26084 KEV ransomware
- CVE-2021-26855 KEV ransomware
- CVE-2021-26857 KEV ransomware
- CVE-2021-26858 KEV ransomware
- CVE-2021-2701
- CVE-2021-27065 KEV ransomware
- CVE-2021-27101 KEV ransomware
- CVE-2021-27102 KEV ransomware
- CVE-2021-27103 KEV ransomware
- CVE-2021-27104 KEV ransomware
- CVE-2021-27876 KEV ransomware
- CVE-2021-27877 KEV ransomware
- CVE-2021-27878 KEV ransomware
- CVE-2021-28799 KEV ransomware
- CVE-2021-31166 KEV
- CVE-2021-31207 KEV ransomware
- CVE-2021-3120710
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
- CVE-2021-345239
- CVE-2021-35211 KEV ransomware
- CVE-2021-35464 KEV ransomware
- CVE-2021-36942 KEV ransomware
- CVE-2021-38647 KEV ransomware
- CVE-2021-4034 KEV ransomware
- CVE-2021-40347
- CVE-2021-40444 KEV ransomware
- CVE-2021-40539 KEV ransomware
- CVE-2021-42278 KEV ransomware
- CVE-2021-44228 KEV ransomware
- CVE-2021-44529 KEV ransomware
- CVE-2021-45046 KEV ransomware
- CVE-2021-45105
- CVE-2022-1388 KEV ransomware
- CVE-2022-1471
- CVE-2022-21587 KEV ransomware
- CVE-2022-21919 KEV
- CVE-2022-22954 KEV ransomware
- CVE-2022-22960 KEV
- CVE-2022-22972
- CVE-2022-24521 KEV ransomware
- CVE-2022-26134 KEV ransomware
- CVE-2022-27924 KEV ransomware
- CVE-2022-30190 KEV ransomware
- CVE-2022-40507
- CVE-2022-41040 KEV ransomware
- CVE-2022-41082 KEV ransomware
- CVE-2022-47986 KEV ransomware
- CVE-2023-0669 KEV ransomware
- CVE-2023-20198 KEV
- CVE-2023-20269 KEV ransomware
- CVE-2023-22515 KEV ransomware
- CVE-2023-22518 KEV ransomware
- CVE-2023-22522
- CVE-2023-22523
- CVE-2023-23397 KEV
- CVE-2023-27350 KEV ransomware
- CVE-2023-27351 KEV ransomware
- CVE-2023-27532 KEV ransomware
- CVE-2023-2868 KEV
- CVE-2023-3284
- CVE-2023-34048 KEV
- CVE-2023-34362 KEV ransomware
- CVE-2023-3466
- CVE-2023-3467
- CVE-2023-3519 KEV ransomware
- CVE-2023-36884 KEV ransomware
- CVE-2023-38831 KEV ransomware
- CVE-2023-40044 KEV ransomware
- CVE-2023-40077
- CVE-2023-40088
- CVE-2023-42793 KEV ransomware
- CVE-2023-45866
- CVE-2023-46604 KEV ransomware
- CVE-2023-46805 KEV ransomware
- CVE-2023-47246 KEV ransomware
- CVE-2023-48788 KEV ransomware
- CVE-2023-4911 KEV
- CVE-2023-4966 KEV ransomware
- CVE-2023-50164
- CVE-2024-0012 KEV ransomware
- CVE-2024-1708 KEV ransomware
- CVE-2024-1709 KEV ransomware
- CVE-2024-21887 KEV ransomware
- CVE-2024-21893 KEV ransomware
- CVE-2024-21983
- CVE-2024-24919 KEV ransomware
- CVE-2024-26169 KEV ransomware
- CVE-2024-27198 KEV ransomware
- CVE-2024-3400 KEV ransomware
- CVE-2024-4577 KEV ransomware
- CVE-2024-47575 KEV
- CVE-2024-9474 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
Show all 143 reports Show fewer
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BlackCat (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BlackCat (Malware Family)
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
-
ALPHV, BlackCat Gang - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor ALPHV, BlackCat Gang - Threat Group Cards: A Threat Actor Encyclopedia
-
Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor watchtower-2023-eoy-report-en
-
ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access
-
PwC Cyber Threats 2022: A Year in Retrospect.pdf
The original link failed its last check. Original publisher Detailsfor PwC Cyber Threats 2022: A Year in Retrospect.pdf
-
Bee-Ware of Trigona, An Emerging Ransomware Strain
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bee-Ware of Trigona, An Emerging Ransomware Strain
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware review- March 2023
-
ALPHV-BlackCat ransomware family becoming more dangerous
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ALPHV-BlackCat ransomware family becoming more dangerous
-
Crimeware Trends - Ransomware Developers Turn to Intermittent Encryption to Evade Detection
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Crimeware Trends - Ransomware Developers Turn to Intermittent Encryption to Evade Detection
-
The Increase in Ransomware Attacks on Local Governments
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Increase in Ransomware Attacks on Local Governments
-
How cybercriminals are weaponizing leaked ransomware data for follow-up attacks
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How cybercriminals are weaponizing leaked ransomware data for follow-up attacks
-
A Deep Dive Into ALPHV-BlackCat Ransomware
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Deep Dive Into ALPHV-BlackCat Ransomware
-
Fat Cats - An analysis of the BlackCat ransomware affiliate program
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fat Cats - An analysis of the BlackCat ransomware affiliate program
-
BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet- Tech Dive
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet- Tech Dive
-
Microsoft Word - Blackcat_FLASH_FINAL 04192022
The original link failed its last check. Original publisher Detailsfor Microsoft Word - Blackcat_FLASH_FINAL 04192022
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware Threat Report 2022
-
Falcon OverWatch Threat Hunting Contributes to Seamless Protection Against Novel BlackCat Attack
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Falcon OverWatch Threat Hunting Contributes to Seamless Protection Against Novel BlackCat Attack
-
The Ransomware Threat Landscape: What to Expect in 2022
The original link failed its last check. Original publisher Detailsfor The Ransomware Threat Landscape: What to Expect in 2022
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware Profile- ALPHV
-
Who Wrote the ALPHV-BlackCat Ransomware Strain-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who Wrote the ALPHV-BlackCat Ransomware Strain-
-
Threat Assessment- BlackCat Ransomware
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Assessment- BlackCat Ransomware
-
ALPHV ransomware gang analysis
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ALPHV ransomware gang analysis
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ALPHV (BlackCat) Ransomware
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BlackCat Ransomware
Newest first. Details opens the report in Explore.