Justice Department Disrupts Blackcat Ransomware Group, Saving Victims Millions
In a significant move to combat cybercrime, the Justice Department announced today a disruption campaign against the Blackcat ransomware group, also known as ALPHV or Noberus. The group has targeted the computer networks of over 1,000 victims worldwide, including networks supporting critical infrastructure in the United States.
Over the past 18 months, ALPHV/Blackcat has become the second most prolific ransomware-as-a-service variant globally, with victims paying hundreds of millions of dollars in ransoms. Multiple foreign law enforcement agencies are conducting parallel investigations due to the global scale of these crimes.
The FBI played a crucial role in the operation, developing a decryption tool that allowed over 500 affected victims to restore their systems. This effort, conducted in collaboration with law enforcement partners globally, saved multiple victims from ransom demands totaling approximately $68 million. The FBI also gained visibility into the Blackcat ransomware group's network and seized several websites operated by the group, as detailed in an unsealed search warrant in the Southern District of Florida.
Deputy Attorney General Lisa O. Monaco stated, "In disrupting the BlackCat ransomware group, the Justice Department has once again hacked the hackers," emphasizing the priority of placing victims at the center of the strategy to combat cybercrime.
FBI Deputy Director Paul Abbate emphasized the FBI's relentless pursuit of cybercriminals, stating, "Helping victims of crime is the FBI’s highest priority." The FBI will continue to aggressively pursue criminal actors involved in ransomware campaigns targeting critical infrastructure.
Acting Assistant Attorney General Nicole M. Argentieri highlighted the ongoing nature of the efforts, stating, "Criminal actors should be aware that the announcement today is just one part of this ongoing effort. Going forward, we will continue our investigation and pursue those behind Blackcat until they are brought to justice."
U.S. Attorney Markenzy Lapointe for the Southern District of Florida acknowledged the Justice Department's ability to take on sophisticated cybercriminals, emphasizing ongoing efforts to hold the people behind the Blackcat ransomware group accountable for their crimes.
According to the unsealed warrant, Blackcat actors have compromised computer networks globally, affecting U.S. critical infrastructure, government facilities, emergency services, defense industrial base companies, critical manufacturing, healthcare, public health facilities, corporations, government entities, and schools. The financial impact globally is in the hundreds of millions, covering ransom payments, data destruction and theft, and incident response costs.
Blackcat utilizes a ransomware-as-a-service model, involving developers responsible for creating and updating ransomware, maintaining illicit internet infrastructure, and affiliates identifying and attacking high-value victims.
The FBI Miami Field Office is leading the investigation.
Victims of Blackcat ransomware are strongly encouraged to contact their local FBI field office at www.fbi.gov/contact-us/field-offices for further information and to determine what assistance may be available.
