An FBI takedown slowed ALPHV but did not end its affiliate model

What happened

In December 2023, law enforcement took action against the infrastructure of ALPHV, also known as Blackcat, a ransomware-as-a-service operation. The FBI, CISA and the Department of Health and Human Services subsequently issued a joint cybersecurity advisory, first published 19 December 2023, describing ALPHV Blackcat's affiliate model and noting that the group's administrators responded to the operational action by encouraging affiliates to target hospitals. The advisory's February 2024 update recorded that, since mid-December 2023, nearly seventy leaked victims had been posted, with healthcare the most commonly targeted sector.

Two months after the disruption, on the morning of 21 February 2024, a ransomware attack identified by UnitedHealth Group's chief executive in Senate testimony as ALPHV or BlackCat encrypted Change Healthcare's systems. Independent reporting from security journalist Brian Krebs described a cryptocurrency address linked to BlackCat receiving a transaction of approximately 22 million dollars on 1 March 2024, followed by an affiliate's public claim of being denied a promised share, and the group's dark web sites subsequently going dark.

Confidence and limits

The advisory and the Senate record are official documents describing, respectively, the group's tactics and the fact that the same ransomware brand struck again after the disruption; both support the conclusion that the operation degraded rather than eliminated the group. The ransom figure and the exit-scam narrative rest on blockchain tracing and forum posts reported by a named security journalist, using hedged language such as apparent, and have not been confirmed here through a court filing or regulatory action naming the responsible individuals.

Why it mattered

The sequence illustrates a structural feature of ransomware-as-a-service: seizing a leak site or issuing a decryptor removes visible infrastructure but does not necessarily remove the people, code or affiliate relationships behind it. An administrator who can plausibly abscond with a ransom payment, as reported here, exposes a fault line within the criminal business model itself, since affiliates depend on the operator's honesty to get paid. That same fragility can drive affiliates toward newer brands, which is part of why a rotating cast of ransomware-as-a-service names keeps reappearing under different labels.

Defensive takeaway

Treat a disruption announcement as a reason to increase vigilance for the tactics described in the advisory, not a reason to stand down, since the same affiliates and techniques can resurface under a new or unchanged brand within weeks.

• Do we track indicators associated with ransomware-as-a-service affiliates generally, rather than only by brand name, since affiliates move between operations?
• Have we reviewed the mitigations in the joint advisory, including phishing-resistant multifactor authentication on remote access tools, regardless of whether ALPHV specifically targets our sector?
• If we were extorted, do we have a plan for verifying a criminal group's claims that data would be deleted, given the reported history of unreliable conduct even toward affiliates?

The gap between a law-enforcement announcement and a group's actual capability is where defenders can be misled twice: once by assuming a disrupted brand is gone, and again by assuming a criminal operator's promises to its own affiliates, let alone its victims, are reliable.