PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
MITRE ATT&CK G1014

ALPHV / BlackCat

View MITRE Group Page ↗
Aliases: BlackCat, Noberus
Official Attribution Source: DOJ Takedown & CISA Joint Advisory AA23-353A

Key Facts

Jurisdiction
Russian Federation
Geographic origin
Cases
3
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
1
OFAC designations
  • Attributed Country: Russian Federation.
  • ATT&CK Group Reference: G1014 (ALPHV / BlackCat).
  • Linked to 3 primary court prosecution record(s) with $2.6 billion documented loss.
  • Identified 0 individually charged operative(s) and 1 OFAC designation(s).

Primary ATT&CK Techniques Employed

ATT&CK Techniques Mapped to ALPHV / BlackCat Technique frequencies extracted from verified indictments for ALPHV / BlackCat. T1078 Valid Accounts 1 incidents T1486 Data Encrypted for Impact 1 incidents T1567 Exfiltration Over Web Service 1 incidents T1041 Exfiltration Over C2 Channel 1 incidents T1133 External Remote Services 1 incidents T1087 Account Discovery 1 incidents T1530 Data from Cloud Storage 1 incidents T1562.001 Disable or Modify Tools 1 incidents
Technique frequencies extracted from verified indictments for ALPHV / BlackCat.
ATT&CK Techniques Mapped to ALPHV / BlackCat
Technique Frequency
T1078 Valid Accounts 1 incidents
T1486 Data Encrypted for Impact 1 incidents
T1567 Exfiltration Over Web Service 1 incidents
T1041 Exfiltration Over C2 Channel 1 incidents
T1133 External Remote Services 1 incidents
T1087 Account Discovery 1 incidents
T1530 Data from Cloud Storage 1 incidents
T1562.001 Disable or Modify Tools 1 incidents

Prosecution Cases Attributed to ALPHV / BlackCat

ALPHV / BlackCat Ransomware Attack on Change Healthcare

alleged 2024-02-21

Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.

Primary Attack Mechanism: Stolen credentials used to enter an unsegmented Citrix remote access portal lacking multifactor authentication, combined with exploitation of ScreenConnect (CVE-2024-1709) for persistence.
6 techniques mapped · Loss: $2.5 billion View full case dossier →

Prudential Financial ALPHV BlackCat Cloud Tenant Compromise

investigation 2024-02-05

Material cybersecurity breach of Fortune 100 life insurer Prudential Financial, wherein ALPHV/BlackCat threat actors breached corporate administrative workstations and accessed cloud tenant data, filed under the four-day SEC Form 8-K Item 1.05 reporting mandate.

Primary Attack Mechanism: Compromised administrative credentials utilized to breach administrative workstations and cloud management infrastructure at Prudential Financial.
2 techniques mapped · Loss: $35.0 million View full case dossier →

Operation Dawnbreaker (Hive Ransomware Syndicate Takedown)

convicted 2023-01-26

Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.

Primary Attack Mechanism: Initial access established against Healthcare & Hospital Systems infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.
2 techniques mapped · Loss: $100.0 million View full case dossier →

Treasury OFAC Sanctions Actions

ALPHV / BlackCat Leadership 2024-03-27

Up to $10,000,000 reward for information leading to identification of leaders of the ALPHV/BlackCat ransomware group responsible for Change Healthcare outage.

Official Treasury Press Release ↗

Documented TTP Signature for ALPHV / BlackCat

Test Controls in Stack Audit →
T1078: Valid Accounts

Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
T1486: Data Encrypted for Impact

Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.
T1567: Exfiltration Over Web Service

Adversaries exfiltrate sensitive files to legitimate cloud storage providers like Mega or Google Drive.
T1041: Exfiltration Over C2 Channel

Adversaries transmit stolen data over existing command and control channels back to adversary servers.
T1133: External Remote Services

Adversaries connect to external-facing VPNs, Citrix gateways, and portals using stolen credentials.
T1087: Account Discovery

Adversaries enumerate domain and local user accounts to locate high-privilege targets.