Hunting and remediating BlackCat ransomware (Clone)

guardsix — Wed, 06 May 2026 13:17:32 GMT

By Anish Bogati and Bibek Thapa Magar; Security Research

TL;DR

Known by many names, including ALPHV, AlphaV, ALPHVM, and Noberus, BlackCat ransomware made headlines for its successive attacks on high-profile targets.

The highest ransom they have demanded so far is $14 million and it’s speculated that it has similarities with ransomware families like Darkside, Blackmatter, and REvil in regard to the tools, filenames, and techniques they use.

Despite this speculation, Recorded Future’s interview with the representative of BlackCat confirmed that, as yet, there is no connection.

So far, the ransomware has affected organizations globally, both small and large in size, and from multiple industries including critical infrastructure sectors, such as government agencies, construction, manufacturing, education, insurance, and transportation.

According to our research, BlackCat has the fourth highest number of victims with 90 known victims.

Analytics for the top ransomware groups are available for download in guardsix Alert Rules.

*Blog contains detailed analysis and investigation & response via guardsix.

Product Updates

Hunting and remediating BlackCat ransomware (Clone)

TL;DR