ALPHV/BlackCat

ALPHV, also sold as BlackCat, launched in November 2021 as a ransomware-as-a-service platform. Its operators supplied an encryptor written in Rust, a leak site and negotiation tooling, while outside affiliates broke into victims and paid the core team a share of each ransom. Healthcare providers, critical infrastructure and energy companies were among its targets, and ALPHV ranked among the busiest ransomware platforms worldwide.

The FBI and the US Department of Justice disrupted ALPHV in December 2023, seizing its site and releasing decryption keys. Affiliates still used the brand afterwards, most damagingly against Change Healthcare in February 2024. ALPHV's operators then ran an exit scam on their own affiliates and shut down, and many affiliates moved to other ransomware platforms.

In early 2026 the US Department of Justice secured guilty pleas from two incident responders who had run ALPHV attacks themselves. Ryan Goldberg, 40, worked for the incident-response firm Sygnia; Kevin Martin, 36, negotiated ransoms at DigitalMint. Each admitted conspiracy to obstruct commerce by extortion for deploying ALPHV/BlackCat against US victims between April and December 2023, and used their professional access to choose targets. Since the Goldberg and Martin pleas, buyers of incident-response services ask about personnel vetting and privilege controls, not only technical skill.