{"id":57013,"date":"2024-09-04T14:41:45","date_gmt":"2024-09-04T14:41:45","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36295\/Cicada-Ransomware-May-Be-A-BlackCat-ALPHV-Rebrand-And-Upgrade.html"},"modified":"2024-09-04T14:41:45","modified_gmt":"2024-09-04T14:41:45","slug":"cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/","title":{"rendered":"Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade"},"content":{"rendered":"<p>The Cicada3301 ransomware, which has claimed at least 20 victims since it was spotted in June, shares &#8220;striking similarities&#8221; with the notorious BlackCat ransomware, according to security researchers at Israeli outfit endpoint security outfit Morphisec.<\/p>\n<p>Morphisec\u2019s threat intelligence team on Tuesday published an <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/blog.morphisec.com\/cicada3301-ransomware-threat-analysis\">analysis<\/a> of Cicada3301 that asserts it was coded in Rust \u2013 <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2023\/08\/18\/microsoft_spots_new_blackcat_ransomware\/\" rel=\"noopener\">just like BlackCat<\/a>.<\/p>\n<p>Cicada shares other characteristics with BlackCat, including how it tries to delete shadow copies that Windows Server can create to create point-in-time replicas of useful files. Deleting those copies could make ransomware recovery harder. The malware manipulates Windows&#8217; Volume Snapshot Service (vssadmin) which helps to create the shadow copies, and then it calls on Windows Management Instrumentation (WMI). It also tampers with the &#8220;bcdedit&#8221; utility in an attempt to prevent victims from recovering encrypted systems.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Morphisec also spotted customizations such as embedding compromised user credentials within the ransomware, and then executing the malware with the valid credentials using a renamed Sysinternals remote management tool called <code>psexec<\/code>.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>&#8220;While the ransomware notes and ransomware encryption have been customized per victim, compromised credentials integrated within a ransomware is a new level of customization,&#8221; the researchers wrote in <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/regmedia.co.uk\/2024\/09\/03\/morphisec_cicada3301_report.pdf\">a report<\/a> [PDF].<\/p>\n<h3 class=\"crosshead\">Like the puzzles<\/h3>\n<p>The ransomware is named after the <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/en.wikipedia.org\/wiki\/Cicada_3301\">three puzzles<\/a> posted online between 2012 and 2014. The third remains unsolved, and the puzzles&#8217; creator(s) remain a mystery \u2013 just like the developers of the Cicada3301 ransomware.<\/p>\n<p>Morphisec&#8217;s technical analysis of the ransomware also includes indicators of compromise. That&#8217;s especially useful, because the developers continue to improve the malware&#8217;s anti-detection capabilities.<\/p>\n<p>Two Cicada samples that have been active during the past two weeks show a <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.virustotal.com\/gui\/file\/dd98133b825a1632879b689b864b15a66741208343bc8ba080354e0133181d69\">static scanning of 0<\/a> on VirusTotal \u2013 meaning that no vendors have yet flagged the file as malicious \u2013 and 1, which was recently <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.virustotal.com\/gui\/file\/7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e\">flagged by CrowdStrike Falcon<\/a>.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>A month-old sample shows <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.virustotal.com\/gui\/file\/3969e1a88a063155a6f61b0ca1ac33114c1a39151f3c7dd019084abd30553eab\">24 detections<\/a>. Between August 4 and August 7 \u2013 during which various vendors&#8217; endpoint products began flagging the malware \u2013 the developers increased the size of the ransomware from about 7MB to 17MB, according to Morphisec CTO Michael Gorelik. He told <em>The Register<\/em> that this &#8220;may be one of the challenges&#8221; with detection.<\/p>\n<p>Additionally, the mystery developers &#8220;moved from 64bit to 32bit, and changed some of the sections while introducing some additional obfuscation,&#8221; Gorelik added.<\/p>\n<p>&#8220;It seems that either they or someone else were uploading a lot of chunks from the old samples to test for detection. Possibly they were working during the past month on reduction of static detection, and it seems that this worked for them,&#8221; he said.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Morphisec spotted the malware in one of its customers&#8217; environments last week after the ransomware bypassed an unnamed &#8220;leading&#8221; endpoint detection and response product. The researchers also uncovered the ransomware using EDRSandBlast \u2013 a tool that detects monitoring behavior by endpoint detection and response tools \u2013 that is often used to tamper with endpoint security products.<\/p>\n<h3 class=\"crosshead\">SMBs in the crosshairs<\/h3>\n<p>Since June 18, Cicada has infected at least 13 small- and medium-sized businesses, five mid-sized organizations, and three enterprises in North America and England, Gorelik wrote in a Tuesday post. Attackers who deployed the code sought payment in Bitcoin and Monero.<\/p>\n<p>&#8220;With the limited visibility Morphisec researchers currently have, it appears that Cicada3301 ransomware primarily targets small to medium-sized businesses (SMBs), likely through opportunistic attacks that exploit vulnerabilities as the initial access vector,&#8221; he <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/blog.morphisec.com\/cicada3301-ransomware-threat-analysis\">observed<\/a>.<\/p>\n<p>Meanwhile, Truesec threat hunters previously <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.truesec.com\/hub\/blog\/dissecting-the-cicada\">noted<\/a> that the first data dump on the group behind Cicada3301\u2019s leak site is dated June 25. Four days later, the crew invited affiliates to join their ransomware-as-a-service platform.<\/p>\n<p>The timing of Cicada3301\u2019s debut is significant, given that the operators of BlackCat \u2013 an outfit known as ALPHV \u2013 are of great interest to investigators since the ransomware was infamously <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2024\/05\/08\/unitedhealths_egregious_negligence\/\" rel=\"noopener\">used to cripple<\/a> US pharmacies and hospitals that use Change Healthcare&#8217;s insurance and billing services earlier this year.<\/p>\n<p>Before the Change Healthcare attack, in December 2023, an FBI-led operation <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.theregister.com\/2023\/12\/19\/blackcat_domain_seizure\">seized<\/a> ALPHV\/BlackCat&#8217;s websites and released a decryptor tool.<\/p>\n<p>Then in March, after an affiliate <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2024\/03\/04\/alphv_ransom_payment\/\" rel=\"noopener\">locked up<\/a> Change&#8217;s IT systems, ALPHV pulled an <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2024\/03\/08\/change_healthcare_restores_first_system\/\" rel=\"noopener\">exit scam<\/a> shortly after the ransom was allegedly paid.<\/p>\n<p>Upgrading BlackCat to Cicada3301 with better EDR evasion \u2013 and a rebrand \u2013 may have been a play to keep the criminal crew in business. \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/36295\/Cicada-Ransomware-May-Be-A-BlackCat-ALPHV-Rebrand-And-Upgrade.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[8839],"class_list":["post-57013","post","type-post","status-publish","format-standard","hentry","category-cybersecurity-blogs","tag-headlinehackermalwaredata-losscryptography"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-09-04T14:41:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Cicada Ransomware May Be A BlackCat\\\/ALPHV Rebrand And Upgrade\",\"datePublished\":\"2024-09-04T14:41:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/\"},\"wordCount\":705,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"keywords\":[\"headline,hacker,malware,data loss,cryptography\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/\",\"name\":\"Cicada Ransomware May Be A BlackCat\\\/ALPHV Rebrand And Upgrade 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2024-09-04T14:41:45+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,malware,data loss,cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackermalwaredata-losscryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Cicada Ransomware May Be A BlackCat\\\/ALPHV Rebrand And Upgrade\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/","og_locale":"en_US","og_type":"article","og_title":"Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-09-04T14:41:45+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade","datePublished":"2024-09-04T14:41:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/"},"wordCount":705,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","keywords":["headline,hacker,malware,data loss,cryptography"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/","url":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/","name":"Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2024-09-04T14:41:45+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ztiu0D2K4pW1Sdu71SFVWQAAAcE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/cicada-ransomware-may-be-a-blackcat-alphv-rebrand-and-upgrade\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,malware,data loss,cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackermalwaredata-losscryptography\/"},{"@type":"ListItem","position":3,"name":"Cicada Ransomware May Be A BlackCat\/ALPHV Rebrand And Upgrade"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/57013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=57013"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/57013\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=57013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=57013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=57013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}