Noberus

Noberus, also known as ALPHV or BlackCat, is a significant threat actor in the cybersecurity landscape. The group, which primarily operates a ransomware-as-a-service (RaaS) model, was the second most active ransomware group in April 2023, responsible for 14% of total observed victims. Originating from Russia and first appearing in November 2021, Noberus utilizes a variant written in Rust, enabling it to infect both Windows and Linux-based systems. The group's modus operandi involves stealing sensitive data from institutions and threatening to publish it unless a ransom is paid. The threat posed by Noberus has been recognized by major cybersecurity firms and government agencies alike. Threat researchers from Symantec, a part of Broadcom, have observed the FIN8 cyber-crime group deploying a variant of the Sardonic backdoor to deliver the Noberus ransomware. Furthermore, the U.S. Department of Justice announced a disruption campaign against Noberus, citing its harmful impact on over 1,000 victims' computer networks, including those supporting U.S. critical infrastructure. However, recent developments suggest a shift in the ransomware landscape. The closure of Noberus earlier this year has led to some of its former affiliates joining other groups, contributing to their growth. Notably, a former Noberus affiliate known as Notchy is now reportedly working with RansomHub, a new ransomware group. Tools previously associated with another Noberus affiliate, Scattered Spider, were also used in a recent RansomHub attack, indicating the potential transfer of tactics, techniques, and procedures between these threat actors.