ALPHV Blackcat RaaS targets healthcare with social engineering
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
FBI/CISA joint advisory on ALPHV Blackcat ransomware-as-a-service operations, updated February 2024 with IOCs and TTPs.
FBI, CISA, and HHS released a joint advisory documenting ALPHV Blackcat (also known as BlackCat) ransomware-as-a-service operations observed through February 2024. This update to prior advisories from April 2022 and December 2023 reflects the group's shift toward healthcare targeting following operational disruption in early December 2023. The advisory notes ALPHV Blackcat released version 2.0 (Sphynx) in February 2023 with enhanced defense evasion, multi-platform encryption (Windows, Linux, VMware), and expanded affiliate tooling.
ALPHV Blackcat affiliates employ social engineering for initial access, posing as IT/helpdesk staff via phone or SMS to steal credentials. Post-compromise, they deploy remote access tools (AnyDesk, Mega sync, Splashtop, Plink, Ngrok), leverage beacons (Brute Ratel C4, Cobalt Strike), and use open-source tools like Evilginx2 for MFA bypass. The group exfiltrates data via Mega.nz or Dropbox, deploys encryption, and communicates demands through Tor, Tox, or victim-specific email. Some variants conduct pure extortion without encrypting. Operators delete victim data post-exfiltration and offer fake security remediation as negotiation leverage.
Defenders should prioritize phishing-resistant MFA, application allowlisting, network monitoring for lateral movement, social engineering training, and endpoint detection tools. Healthcare organizations are at elevated risk and should follow sector-specific CPG guidance.
Mentioned in this report
Detection guidance
Cobalt Strike or Brute Ratel Default Named Pipe Created
Detects creation of named pipes used by default Cobalt Strike and Brute Ratel C4 beacons, both named as post-compromise tooling in ALPHV Blackcat intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cobalt Strike or Brute Ratel Default Named Pipe Created
description: Detects creation of default named pipes associated with Cobalt Strike
(WkSvcPipeMgr, MSSE-*-server, hashdump, 334485, 461092) and Brute Ratel C4 (brutepipe).
Both beacon frameworks are used by ALPHV Blackcat affiliates for post-compromise
lateral movement.
tags:
- attack.lateral-movement
- attack.t1021
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName:
- \WkSvcPipeMgr_*
- \MSSE-*-server
- \hashdump
- \334485
- \461092
- \brutepipe
condition: selection
falsepositives:
- Red team or penetration test exercises using default beacon profiles
- Rare legacy security software that creates pipes with an MSSE-prefixed name
level: high
id: ec2ba051-eab0-5418-bb8c-81c2cb88a80a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
Plink or Ngrok Used for Remote Port Forwarding or Tunnelling
Detects Plink reverse port forwarding and Ngrok tunnel or authtoken commands, remote access tools named in ALPHV Blackcat affiliate tradecraft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Plink or Ngrok Used for Remote Port Forwarding or Tunnelling
description: Detects plink.exe creating SSH remote port forwards and ngrok.exe configuring
an authtoken or starting a tcp/http/tls tunnel. ALPHV Blackcat affiliates use Plink
and Ngrok for persistent remote access into victim networks.
tags:
- attack.lateral-movement
- attack.t1021
logsource:
category: process_creation
product: windows
detection:
selection_plink:
Image|endswith: \plink.exe
CommandLine|contains:
- ' -R '
- ' -L '
- ' -D '
selection_ngrok:
Image|endswith: \ngrok.exe
CommandLine|contains:
- authtoken
- ' tcp '
- ' http '
- ' tls '
condition: 1 of selection_*
falsepositives:
- Administrators using Plink for sanctioned SSH tunnels
- Developers using Ngrok to expose local test services
level: medium
id: 7055957b-9ab5-5216-bf49-a60daa33a137
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
Non-Browser Process Resolving Mega.nz Cloud Storage
Detects non-browser processes resolving Mega cloud storage domains, consistent with Mega sync clients or tools used by ALPHV Blackcat for data exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Browser Process Resolving Mega.nz Cloud Storage
description: Detects DNS queries for mega.nz or mega.io domains from processes that
are not common web browsers. ALPHV Blackcat affiliates deploy Mega sync tooling
and exfiltrate victim data to Mega.nz.
tags:
- attack.exfiltration
- attack.t1020
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|endswith:
- .mega.nz
- .mega.io
- .mega.co.nz
filter_browsers:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \iexplore.exe
- \brave.exe
condition: selection and not filter_browsers
falsepositives:
- Users running an approved MEGAsync client
- Browser helper or update processes that are not in the filter list
level: medium
id: d21c1729-66b1-5b84-aa52-2dbd373ab463
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs