ALPHV/Blackcat Ransomware as a Service

NAME: ALPHV/Blackcat Ransomware as a Service (RaaS)
NATIONALITY: Various (Unknown)
CITIZENSHIP: Various (Unknown)

The U.S. Department of State is offering a reward of up to $10,000,000 for information leading to the identification or location of any individual(s) who hold a key leadership position in the Transnational Organized Crime group behind the ALPHV/Blackcat ransomware variant.  In addition, a reward offer of up to $5,000,000 is offered for information leading to the arrest and/or conviction in any country of any individual conspiring to participate in or attempting to participate in ALPHV/Blackcat ransomware activities.

On December 19, 2023, the Department of Justice (DOJ) and the FBI announcement of cooperation with an international group of law enforcement agencies from the United Kingdom, Australia, Germany, Spain, and Denmark, to conduct a disruption campaign against the notorious ransomware gang ALPHV/Blackcat.  FBI identified ALPHV/Blackcat actors as having compromised over 1,000 victim entities in the United States and elsewhere, including prominent government entities (e.g., municipal governments, defense contractors, and critical infrastructure organizations). To date, the FBI has worked with dozens of victims in the United States and internationally to disseminate a decryption tool to restore victim systems and prevent ransom demand payments of approximately $99 million.

Ransomware is a type of malicious software, or malware, that prevents a user from accessing computer files, systems, or networks until a ransom is paid for their return.  Ransomware incidents can cause costly disruptions to operations and the loss of critical information and data.

The FBI does not support the payment of a ransom in response to a ransomware attack.  Paying ransom demands encourages more ransomware incidents and provides an incentive to become involved in this type of illegal activity.  If you are the victim of a ransomware incident, please visit stopransomware.gov.

Please direct information in response to the reward offer through the following Tor-based tip line (Tor browser required):
he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion.  If you are…