What other aliases and vendor names is BlackCat / ALPHV known by?

BlackCat / ALPHV is tracked across the cybersecurity industry by multiple aliases, including: ALPHV, Noberus, UNC4466.

What are the primary motivations and sponsors of BlackCat / ALPHV?

BlackCat / ALPHV operates from Russia with primary motivation categorized as Financial gain (ransomware), sponsored or affiliated with Financially motivated criminal group.

What vulnerabilities and CVEs does BlackCat / ALPHV actively exploit?

BlackCat / ALPHV has been observed weaponizing vulnerabilities including CVE-2022-22954, CVE-2023-46604.

BlackCat / ALPHV

▲ High Threat Russia

Primary Aliases: UNC4466 ALPHV Noberus

Sponsor / State Affiliation Financially motivated criminal group

Primary Motivation Financial gain (ransomware)

Active Timeline 2021 – Present

Change Healthcare attack ($22M ransom), MGM Resorts, ALPHV exit scam (2024)

⚔️ Weaponized CVE Matrix (2)

CVE-2022-22954

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

CVE-2023-46604

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Healthcare Finance Legal Technology Critical infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

📥 Download Navigator JSON

Command & Control 1

T1071 Data exfiltration before encryption

↗

Exfiltration & Impact 2

T1485 Rust-based ransomware

↗

T1485 Triple extortion

↗

Operational Techniques 2

T1000 ESXi attacks

↗

T1000 Affiliate model

↗

Copied to clipboard

LINK COPIED TO CLIPBOARD

BlackCat / ALPHV

⚔️ Weaponized CVE Matrix (2)

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

SHARE INTELLIGENCE WIRE