(Palo Alto) BlackCat (aka ALPHV) is a ransomware family that surfaced in mid-November 2021 and quickly gained notoriety for its sophistication and innovation. Operating a ransomware-as-a-service (RaaS) business model, BlackCat was observed soliciting for affiliates in known cybercrime forums, offering to allow affiliates to leverage the ransomware and keep 80-90% of the ransom payment. The remainder would be paid to the BlackCat author. The threat actors leveraging BlackCat, often referred to as the 'BlackCat gang,' utilize numerous tactics that are becoming increasingly commonplace in the ransomware space. Notably, they use multiple extortion techniques in some cases, including the siphoning of victim data before ransomware deployment, threats to release data if the ransom is not paid and distributed denial-of-service (DDoS) attacks. Known affiliates are: 1. Subgroup: Scattered Spider
In April 2026, a manufacturing organization in the Middle East was targeted by a ransomware group (PAYLOAD) that weaponized Group Policy Objects (GPOs) to cause widespread disruption and extortion without deploying tradi…
Japanese food logistics giant Nichirei Logistics Group has recovered from a cyberattack that disrupted food deliveries nationwide. RansomHouse, a group known for threatening to leak stolen data rather than encrypting it,…
A Florida man, Angelo John Martino III, was sentenced to 70 months in prison for secretly providing ransomware negotiation details and actively deploying BlackCat ransomware alongside two colleagues. He exploited his rol…
Two major ransomware figures have been brought to justice in separate U.S. court cases. Karen Vardanyan, a Ryuk ransomware operator, pleaded guilty to conspiracy and computer fraud, while Angelo Martino, a ransomware neg…
A former cybersecurity expert, Angelo Martino, was sentenced to 70 months in prison for aiding a ransomware gang, BlackCat/Alphv, by providing confidential information to maximize ransom payments. Two other cybersecurity…
A former ransomware negotiator, Angelo Martino, has been sentenced to 70 months in prison for betraying five victims and providing BlackCat ransomware operators with confidential information, allowing them to demand high…
This analysis from Palo Alto Unit 42 assesses the significant cyber threat landscape surrounding the 2026 FIFA World Cup, highlighting the expanded attack surface created by the event's scale and complexity. The report i…
In Q1 2026, Kaspersky products blocked over 343 million attacks, with significant ransomware activity including 2938 new ransomware variants and 77,000 ransomware attacks. Law enforcement actions disrupted the RAMP cyber…
This article from Cisco Talos highlights the importance of broad knowledge beyond traditional cybersecurity for threat intelligence professionals. It emphasizes the need to understand diverse fields like economics and in…
This article details the ongoing issues surrounding the BlackCat ransomware gang’s affiliate, who attempted to defraud the group after carrying out a significant attack on Change Healthcare. The incident highlights the i…
