BlackCat ransomware site down amidst rumours of law enforcement action
The ALPHV data leak site, along with the Tor negotiation URLs shared with victims in ransom notes, went offline on 7th December and have yet to be restored.
Security researchers, including Yelisey Bohuslavkiy, chief research officer at RedSense, have hinted at a possible law enforcement operation targeting the group.
Bohuslavkiy said admins of other top-tier ransomware groups directly linked to ALPHV, including Royal/BlackSuit, BlackBasta and LockBit, confirmed law enforcement involvement in the takedown.
1/3: RedSense Chief Research Officer Yelisey Bohuslavkiy @Migdal_Eli confirms that the threat actors, including #BlackCat‘s affiliates and initial access brokers, are convinced that the shutdown was caused by a law enforcement action.
— RedSense (@RedSenseIntel) December 10, 2023
Despite these rumours, BlackCat’s leadership maintains that “everything will work soon.”
When contacted by BleepingComputer, the ALPHV admin mentioned server repairs, but provided no further details.
ReliaQuest, a security operations centre company, notes that BlackCat’s site has a history of intermittent connectivity issues, although the current outage is among the longest faced by the group.
Notably, no law enforcement agency has officially released information about an operation specifically targeting BlackCat.
ALPHV had previously dismissed the possibility of a takedown effort like the one that targeted the Hive ransomware group in January 2023.
Analysts at ReliaQuest speculate that this disruption could prompt hackers associated with BlackCat to seek new affiliations, or even establish their own ransomware gangs.
“The removal of this group from the ransomware landscape will undoubtedly leave a void, with its operators and affiliates likely moving to other ransomware groups or forming new groups,” said Chris Morgan, senior cyber threat intelligence analyst at ReliaQuest.
The company noted that similar law enforcement actions in the past have resulted in the dispersal of affiliates into new programmes, bringing valuable experience from previous operations.
Who is BlackCat?
BlackCat first appeared in in late 2021 as a ransomware-as-a-service enterprise, offering lucrative payouts of up to 90% of…
