Ransomware attackers aren’t hackers — they’re operators.
Know this and block 90% of their attacks.
If your image of a hacker is someone in a smoky room writing genius code from scratch — you’re about ten years out of date.
Today, ransomware isn’t a myth of lone coders — it’s a business.
It’s Ransomware-as-a-Service (RaaS) — rent the malware, run the playbook, share the profit.
In today’s insight, I break down how BlackCat (ALPHV) defined this model, why it still matters even after its takedown, and the precise actions you can take today to stop most RaaS attacks before they spread.
From this guided insight, you will:
👉 Understand how RaaS really works
👉 Learn what indicators actually matter
👉 See how to block the tools attackers rely on daily
Know your attackers’ tools — defend with precision.
The Myth vs The Model
Here’s the truth: ransomware today isn’t driven by genius — it’s driven by structure.
The days of lone hackers are mostly gone. What’s replaced them is a commercialised underground economy, complete with developers, affiliates, and profit splits.
It’s sold as RaaS — Ransomware-as-a-Service, or as I like to call it, Rent-a-Service.
You don’t need to write code anymore. You use what’s already available — rent it, repurpose it, or customise existing malware, then deploy it and share the profit.
Over time, the market professionalised
A small number of skilled developers began building robust ransomware toolkits — complete with admin panels, payment systems, and documentation.
They offered these platforms to operators on private channels — sometimes rented, sometimes sold, often forked from leaked sources.
Affiliates buy access, find targets, and run the actual attacks.
Developers maintain the platform, manage payments, and take a cut.
That’s how a handful of coders can power hundreds of global breaches.
And BlackCat (ALPHV) is the perfect example of it.
What Is BlackCat (ALPHV)?
Why this matters: It’s the blueprint of professional ransomware operations — modular, cross-platform, and built like commercial software.
BlackCat, also known as ALPHV or Noberus, appeared in late 2021.
It’s written in Rust — one of my favourite languages (also, Go, and Elixir).
Rust is fast, memory-safe, and difficult to reverse-engineer — a perfect match for stealth.
Unlike older strains, BlackCat runs on Windows, Linux, and VMware ESXi, making it a multi-platform threat across both cloud and on-premise systems.
It’s clean code, efficient logic, and professional design — software built for profit, not chaos.
How BlackCat Works
Why this matters: Understanding the flow helps defenders break it — before encryption starts.
BlackCat runs on the Ransomware-as-a-Service model. Developers maintain the platform; affiliates perform the intrusions.
Here’s the attack flow:
Initial Access: via phishing, stolen RDP credentials, or exploited vulnerabilities such as ProxyShell, Log4j, or ESXi flaws.
Lateral Movement: using tools like Cobalt Strike, AnyDesk, or PsExec to move between systems, escalate privileges, and disable defences.
Data Exfiltration: before encryption, sensitive data is stolen for double extortion.
Encryption: files locked using AES-256 + ChaCha20; random seven-character file extensions added; system files skipped to keep devices bootable.
Ransom Demand: note dropped with .onion negotiation link; payment in Bitcoin or Monero.
Affiliates typically keep the majority; developers take a platform cut.
Attack Indicators
Why this matters: Early detection often decides whether an event becomes an incident.
Behavioural Indicators
What to Do About It
Why this matters: Precision beats panic. These actions close the paths BlackCat-style operators rely on.
Multi-Factor Authentication (Platform / SecOps)
Use hardware tokens or certificate-based MFA. Avoid SMS codes.
Verify: sample high-privilege logins weekly.
Patch Vulnerabilities (IT Ops)
Prioritise Exchange (ProxyShell/ProxyLogon), Log4j, VMware ESXi, Fortinet, and SonicWall.
Verify: maintain monthly vuln-to-patch SLA reports.
Network Segmentation (Network / SecOps)
Apply Zero Trust principles. Isolate critical systems and deny lateral movement by default.
Verify: run quarterly lateral-movement drills.
Remote Access Controls (IT Ops)
Allow only approved remote utilities. Block unapproved tools via Group Policy.
Verify: weekly software inventory diff.
Backups (IT Ops)
Follow the 3-2-1 rule — three copies, two media types, one offline/air-gapped.
Verify: monthly restore test with documented outcome.
EDR + Threat Hunting (SecOps)
Monitor for Rust payloads, Cobalt Strike traffic, mass encryption events, and unusual data staging.
Verify: weekly hunt reports with IOC analysis.
Identity & Privilege Controls (SecOps / HR)
Use least privilege, rotate admin credentials, and enable Just-in-Time access.
Verify: monthly elevated-access reviews.
Insider Risk Monitoring (SecOps / HR)
Track unusual admin behaviour, privilege escalations, and access patterns.
Verify: behavioural analytics report + escalate deviations.
Quick Wins (5 Minutes)
Why this matters: Small changes compound fast. These actions close the gaps that attackers rely on daily.
Most attackers don’t write code on the fly.
They use everyday admin tools — the same ones your IT team trusts.
Stop them from using these, and you block them.
🖥️ RDP — a leading initial access vector
Disable external RDP.
If needed, put it behind a VPN or jump host.
Enforce hardware MFA (YubiKey).
Monitor failed logins + geo anomalies.
🎯 Cobalt Strike — cracked beacon control
Ingest CISA IOCs for active C2 campaigns.
Use community SSL/TLS intel feeds (e.g. abuse.ch SSLBL).
Enable EDR/IDS analytics for Beacon patterns; domain blocks alone don’t suffice.
🧰 AnyDesk / TeamViewer — remote backdoors
Whitelist approved tools.
Block or remove unapproved versions via Group Policy.
Restrict installs to admins only.
🔑 Mimikatz — credential dumper
Enable LSASS protection (RunAsPPL).
Verify WDigest is disabled — off by default on modern Windows; apply KB2871997, then disable on legacy.
Detect dumping behaviour in EDR.
Rotate high-privilege passwords regularly.
⚡ PowerShell + PsExec — built-in weapons
Restrict PowerShell to signed or admin-approved scripts using WDAC (or AppLocker).
Log Event IDs 4104, 4688, and monitor 5861 for WMI persistence.
Limit PsExec use for non-admins; forward logs to SIEM.
Outcome: You’ve now blocked about 90 % of real-world ransomware tradecraft — including BlackCat.
Final Thought
BlackCat isn’t just another ransomware strain — it’s a template for how modern cybercrime scales and sustains itself.
Assume breach. Verify everything. Patch fast. Segment deep. Back up smart.
Know your attackers’ tools — defend with precision.