Picus Security has published a deep technical analysis of the ALPHV (BlackCat) ransomware, dissecting a live malware sample still under active analysis as of January 2025 — months after the group's infrastructure was supposedly disrupted by the FBI.
The Change Healthcare Catastrophe
The analysis comes in the wake of the February 2024 attack on Change Healthcare, a UnitedHealth Group subsidiary, which compromised the personal information of over 100 million individuals — the largest healthcare data breach in U.S. history. UnitedHealth paid a $22 million ransom to ALPHV. The U.S. Department of State subsequently offered rewards of up to $10 million for information on ALPHV leadership.
Execution: Access Tokens and Command-Line Control
BlackCat's binary requires a 32-byte access token for execution, functioning as an anti-analysis gate. The malware accepts numerous parameters including --paths for targeted encryption, --no-net to disable network discovery, and --no-prop to prevent self-propagation. Living-off-the-land techniques feature heavily, with commands like wmic csproduct get UUID for system fingerprinting and iisreset.exe /stop to halt web services.
Privilege Escalation and Evasion
The malware bypasses User Account Control through the CMSTPLUA COM interface (CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}), silently gaining administrative privileges without triggering UAC prompts. Access token manipulation enables broad system privileges including SeTakeOwnershipPrivilege and SeSecurityPrivilege. All Windows event logs are cleared using wevtutil.exe to cripple forensic investigation.
Encryption and Impact
BlackCat employs AES-128 encryption with the AES key encrypted via RSA public key from its embedded configuration. Encrypted files receive the .uhwuvzu extension with a 4-byte marker (19 47 B2 CE) separating encrypted content from the encrypted key. Multi-threaded encryption ensures rapid file processing across the victim environment.
Recovery is systematically prevented through shadow copy deletion via vssadmin.exe and wmic.exe, and disabling Windows recovery with bcdedit. Registry modifications maximize SMB throughput to 65,535 concurrent requests, accelerating lateral encryption across network shares.
The RaaS Machine
BlackCat's RaaS model offers affiliates an unusually generous 80–90% revenue share, compared to the industry-standard 70%. This economic incentive has driven organic growth, with affiliates reinvesting earnings to scale operations. Notable collaborations include the Scattered Spider partnership that devastated MGM Resorts and Caesars Entertainment in September 2023.