--- title: "Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service" description: ransomware, blackcat, malware, anti-malware, cybersecurity, endpoint protection, cyber protection, RaaS, ransomware as a service canonical_url: https://www.acronis.com/en/tru/posts/important-details-about-blackcat-the-new-version-of-the-alphv-ransomware-as-a-service/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 28 June 2022 # Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service On March 16, 2022, security specialists identified a new version of BlackCat ransomware (so named because the software displays a black cat on the victim’s payment site). These experts also noted that some previous YARA rules no longer match, which will make it difficult to find malicious files. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** The ALPHV ransomware variant, also known as Noberus, was first identified in November of 2021. Threat actors describe it as a next-generation ransomware-as-a-service (RaaS) version that includes four encryption modes and two encryption algorithms (AES and ChaCha20). ALPHV is true cross-platform malware and affects operating systems such as Windows, ESXI, Debian, Ubuntu and ReadyNas. On March 16, 2022, [security specialists identified a new version](https://twitter.com/vxunderground/status/1504207503734804484) of BlackCat ransomware (so named because the software displays a black cat on the victim’s payment site). These experts also noted that some previous YARA rules no longer match, which will make it difficult to find malicious files. **Technical Details** Like the previous version of ALPHV, BlackCat is written in the Rust programming language and is not packed or obfuscated and is executed via a command line or PowerShell with necessary options. Users can access a full list of options by executing the ransomware with the “--help” parameter. See below. ![Image 1: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/80721ef0de706008f082fa893156f71a.png) **What’s New in BlackCat?** While BlackCat shares many similarities and capabilities with ALPHV, it does include many new functions. These include: · --bypass · --drag-and-drop · --drag-and-drop target · --extra-verbose · --no-prop · --no_vm_kill · --no-vm-kill-names · --no-vm-snapshot-kill · --no-wall BlackCat includes more functions that previous versions, and in addition, the configuration file is not embedded into the sample anymore. Instead, threat actors manually drop the configuration file into a victim’s environment. **How is BlackCat Executed?** BlackCat must be executed using the following order: --access-token [OPTION] [SUBCOMMAND]. Similar to ALPHV, with BlackCat, the encryption process won’t start without the access token and produces an error message if users attempt to execute it. ![Image 2: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/d53379f9932d62609516b3225c05d968.png) By viewing this sample statically, we can observe the similarity in the preparation process. To execute all commands, BlackCat uses the “cmd/c” string and the “Wevtutil.exe” Windows utility to obtain access to the event logs. ![Image 3: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/9bd7585d46447c3c784fb65f2e29db5f.png) From there, BlackCat obtains the Machine GUID from the registry and UUID using the wmic command: · _SOFTWARE\\Microsoft\\Cryptography_ ![Image 4: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/cda46ca78b0a37b0308f1b1f575aafbb.png) It uses the “fsutil” system utility to enable “remote-to-remote” and “remote-to-local” symbolic links: · _fsutil behavior set SymlinkEvaluation R2R:1_ · _fsutil behavior set SymlinkEvaluation R2L:1_ BlackCat deletes all volume shadow copies with the “vssadmin.exe” utility and empties the recycle bin. ![Image 5: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/2d4e46a5a3b6fd9303d9e77fa7c8e9bd.png) ![Image 6: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/46b1dba8434efc0fbfe25435762ed516.png) Also, BlackCat uses the “PsExec” utility, which is compressed with zlib and is stored in the sample. This utility enables users to execute programs on remote Windows machines. ![Image 7: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/38b145c03f86b6441719863c0f4aaf18.png) It changes the maximum number of simultaneous outstanding client requests to the server by writing the maximum possible value (65535) to the “MaxMpxCt” parameter in the register. · _reg add HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\ Parameters/v MaxMpxCt /d 65535_ **File Encryption** When it comes to file encryption, BlackCat looks for all available volumes on the computer by obtaining their path names. ![Image 8: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/e7d1f0761e94d23c65af06c83a711f7a.png) If the found volume doesn’t have a path name, it will be mounted. ![Image 9: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/a31669298073c8bd2a45399977852056.png) From there, BlackCat starts to search files using the “FindFirstFile” and “FindNextFile” functions. Like the previous version of ALPHV, BlackCat encrypts files with the AES encryptions algorithm and uses the hardware-supported instructions “aeskeygenassist,” “aesenc,” and “easimc.” ![Image 10: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/c42d7444a0fda93e62df59de0830995a.png) ![Image 11: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/f09ba8322dccd3d0d22f0ffcad6d81f2.png) ![Image 12: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/b9ea6a66e94035968bac0ebb20b57d9b.png) If AES is not supported, BlackCat will use the ChaCha20 encryption algorithm. ![Image 13: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/ef0d3f782694d81cf9bde53cce2c64f7.png) ![Image 14: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/ea79b6c356c16c78e8797981dd77bbd4.png) ## Conclusion While BlackCat is a new version of ransomware, it does use functionality similar to that of the previous ALPHV version. For example, it still uses AES and ChaCha20 encryption algorithms; includes the packed “PsExec” utility; abuses the “fsutil” utility; searches the computer’s hidden partitions to mount it; changes the same registry keys; clears the recycle bin; and deletes shadow copies via “vssadmin.exe.” However, the new version does not contain configuration, so it can be executed without it —functionality that makes it more difficult to analyze. Additionally, the old YARA rules that applied to the previous version do not work with the new version of BlackCat. All of this makes it even more important to use the most effective [anti-malware solutions](https://www.acronis.com/en-us/solutions/cloud/anti-malware-protection/) possible. These solutions should be capable of identifying any cyberthreat ― even those they’ve never seen before so they can immediately shut them down before harm can be done. Interested in learning more? Please visit our [anti-malware site](https://www.acronis.com/en-us/solutions/cloud/anti-malware-protection/) now or [request a brief, no-obligation demo](https://promo.acronis.com/NAM-Weekly-Cyber-Protect-Demos.html) today. ![Image 15: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/1f3285cfe8e5584e2acc3fdd1b1d12b5.png) ## Detected by Acronis ## IoCs ### Files ![Image 16: Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service](https://staticfiles.acronis.com/images/content/d7d0bf4a69099fc9193a9b4cdbbf2b4c.png) Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)