BlackCat/ALPHV Ransomware Group

BlackCat, also tracked as ALPHV and Noberus, was the most technically sophisticated ransomware operation in the criminal ecosystem during its active period from late 2021 through early 2024.

Threat IntelligenceTIDThreatIntermediateCONFIDENTIAL2,217 words9 min readApr 7, 2026

Last updated Apr 11, 2026v2

CLASSIFICATION: CONFIDENTIAL

This article requires CONFIDENTIAL clearance or higher.

What you need

Create a free Nexus ID to access CDA proprietary content including PDM domain explainers, methodology deep-dives, and reconnaissance mission briefings.

Create Nexus ID (Free)

Also at this clearance level

Threat IntelligenceTIDThreatIntermediate

Table of Contents

BlackCat/ALPHV Ransomware Group

What you need

Also at this clearance level

APT28 (Fancy Bear / Forest Blizzard)

Lazarus Group (HIDDEN COBRA / Diamond Sleet)

Salt Typhoon

Single Sign-On (SSO) Architecture

The Academy

The Command Post

The Armory