EXPLORE DIRECTORY
LAST SYNCHRONIZED: 2026-08-27TLP:CLEAR
malware
BlackCat (ALPHV / Sphynx)
EXECUTIVE INTELLIGENCE SUMMARY
Highly customizable Rust-based ransomware-as-a-service (RaaS) specializing in VMware ESXi hypervisor destruction and massive double-extortion exfiltration.
Engineered entirely in Rust for cross-platform speed and evasion, BlackCat utilizes AES-256 and ChaCha20 encryption routines, automated privilege elevation via token duplication, and custom CLI flags for disabling Windows recovery environments and stopping ESXi guest VM daemons.
SOURCE CITATIONS & ATTESTATIONS (1)
FBI & CISA Joint Cybersecurity Advisory: ALPHV/BlackCatCISA / FBI
ALPHV BlackCat Ransomware IOCs and TTPs
TELEMETRY CARDID: malware-blackcat
ENTITY TYPE
malware
INDEXED TAGS
#ransomware#raas#rust#esxi_encryption#double_extortion
CONNECTED ENTITIES (2)VIEW IN GRAPH →