# ALPHV Blackcat RaaS targets healthcare with social engineering

Published: 2025-07-14 · Severity: routine · Sectors: healthcare
Canonical: https://vorant.io/reports/3e7ce3ef-6cec-5738-b16b-57aee38d59d2/alphv-blackcat-raas-targets-healthcare-with-social-engineering

> FBI/CISA joint advisory on ALPHV Blackcat ransomware-as-a-service operations, updated February 2024 with IOCs and TTPs.

FBI, CISA, and HHS released a joint advisory documenting ALPHV Blackcat (also known as BlackCat) ransomware-as-a-service operations observed through February 2024. This update to prior advisories from April 2022 and December 2023 reflects the group's shift toward healthcare targeting following operational disruption in early December 2023. The advisory notes ALPHV Blackcat released version 2.0 (Sphynx) in February 2023 with enhanced defense evasion, multi-platform encryption (Windows, Linux, VMware), and expanded affiliate tooling.

ALPHV Blackcat affiliates employ social engineering for initial access, posing as IT/helpdesk staff via phone or SMS to steal credentials. Post-compromise, they deploy remote access tools (AnyDesk, Mega sync, Splashtop, Plink, Ngrok), leverage beacons (Brute Ratel C4, Cobalt Strike), and use open-source tools like Evilginx2 for MFA bypass. The group exfiltrates data via Mega.nz or Dropbox, deploys encryption, and communicates demands through Tor, Tox, or victim-specific email. Some variants conduct pure extortion without encrypting. Operators delete victim data post-exfiltration and offer fake security remediation as negotiation leverage.

Defenders should prioritize phishing-resistant MFA, application allowlisting, network monitoring for lateral movement, social engineering training, and endpoint detection tools. Healthcare organizations are at elevated risk and should follow sector-specific CPG guidance.

## Mentioned in this report

- Threat actors: ALPHV
- Malware: ALPHV/BlackCat, Brute Ratel C4, Cobalt Strike, POORTRY, STONESTOP, evilginx2

## Detection guidance (public sample)

### Cobalt Strike or Brute Ratel Default Named Pipe Created

ATT&CK: T1021

Detects creation of named pipes used by default Cobalt Strike and Brute Ratel C4 beacons, both named as post-compromise tooling in ALPHV Blackcat intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cobalt Strike or Brute Ratel Default Named Pipe Created
description: Detects creation of default named pipes associated with Cobalt Strike
  (WkSvcPipeMgr, MSSE-*-server, hashdump, 334485, 461092) and Brute Ratel C4 (brutepipe).
  Both beacon frameworks are used by ALPHV Blackcat affiliates for post-compromise
  lateral movement.
tags:
- attack.lateral-movement
- attack.t1021
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \WkSvcPipeMgr_*
    - \MSSE-*-server
    - \hashdump
    - \334485
    - \461092
    - \brutepipe
  condition: selection
falsepositives:
- Red team or penetration test exercises using default beacon profiles
- Rare legacy security software that creates pipes with an MSSE-prefixed name
level: high
id: ec2ba051-eab0-5418-bb8c-81c2cb88a80a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
```

### Plink or Ngrok Used for Remote Port Forwarding or Tunnelling

ATT&CK: T1021

Detects Plink reverse port forwarding and Ngrok tunnel or authtoken commands, remote access tools named in ALPHV Blackcat affiliate tradecraft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Plink or Ngrok Used for Remote Port Forwarding or Tunnelling
description: Detects plink.exe creating SSH remote port forwards and ngrok.exe configuring
  an authtoken or starting a tcp/http/tls tunnel. ALPHV Blackcat affiliates use Plink
  and Ngrok for persistent remote access into victim networks.
tags:
- attack.lateral-movement
- attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection_plink:
    Image|endswith: \plink.exe
    CommandLine|contains:
    - ' -R '
    - ' -L '
    - ' -D '
  selection_ngrok:
    Image|endswith: \ngrok.exe
    CommandLine|contains:
    - authtoken
    - ' tcp '
    - ' http '
    - ' tls '
  condition: 1 of selection_*
falsepositives:
- Administrators using Plink for sanctioned SSH tunnels
- Developers using Ngrok to expose local test services
level: medium
id: 7055957b-9ab5-5216-bf49-a60daa33a137
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
```

### Non-Browser Process Resolving Mega.nz Cloud Storage

ATT&CK: T1020

Detects non-browser processes resolving Mega cloud storage domains, consistent with Mega sync clients or tools used by ALPHV Blackcat for data exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-Browser Process Resolving Mega.nz Cloud Storage
description: Detects DNS queries for mega.nz or mega.io domains from processes that
  are not common web browsers. ALPHV Blackcat affiliates deploy Mega sync tooling
  and exfiltrate victim data to Mega.nz.
tags:
- attack.exfiltration
- attack.t1020
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith:
    - .mega.nz
    - .mega.io
    - .mega.co.nz
  filter_browsers:
    Image|endswith:
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \iexplore.exe
    - \brave.exe
  condition: selection and not filter_browsers
falsepositives:
- Users running an approved MEGAsync client
- Browser helper or update processes that are not in the filter list
level: medium
id: d21c1729-66b1-5b84-aa52-2dbd373ab463
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3e7ce3ef-6cec-5738-b16b-57aee38d59d2/alphv-blackcat-raas-targets-healthcare-with-social-engineering.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup