Who Wrote the ALPHV/BlackCat Ransomware Strain?
Summary: Researchers identified ALPHV/BlackCat in December 2021 as the first professional cybercrime group to use a ransomware strain written in Rust, and Varonis reported the group was recruiting operators from REvil, BlackMatter and DarkSide while offering affiliates up to 90 percent of ransoms paid. A confidential source told KrebsOnSecurity that an ALPHV coder used the handle "Binrs" on Russian-language forums, and reporting traced a shared ToX ID and @CookieDays Telegram account across the handles Binrs, smiseo, YBCat and DuckerMan, with Recorded Future assessing the ALPHV author was previously involved with REvil.
Why it matters: The same ToX identifier and Telegram account linked a claimed ALPHV developer to clipper malware, bot development and bulk malware installs, showing one identity spanning coding, distribution and monetization. Russia's arrest of 14 alleged REvil operators did not reduce REvil detections, which rose modestly the following week, and a $10 million State Department reward still stands for information on REvil leadership.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·