Sphynx

Sphynx, a new variant of the BlackCat ransomware, was announced and launched by ALPHV Blackcat administrators in February 2023. This update, named ALPHV BlackCat Ransomware 2.0 Sphynx, was rewritten to provide additional features to affiliates, including improved defense evasion capabilities and additional tooling. The malware's evolution has been tracked through previous alerts from April 2022 and December 2023, culminating in this formidable iteration. The Sphynx version of BlackCat ransomware introduced advanced capabilities, such as the ability to encrypt both Windows and Linux devices, and VMWare instances. The tooling provided a Linux-based operating system (OS) running Sphynx, the latest BlackCat variant. The additional features and improved defense evasion capabilities make this malware a significant threat to cyber infrastructure. In response to this threat, the US Cybersecurity and Infrastructure Security Agency (CISA) published a security advisory containing updated Indicators of Compromise (IoCs) associated with the BlackCat Ransomware 2.0 Sphynx version released in February 2023. This constant updating of its malware underscores the persistent threat posed by the BlackCat group and the need for ongoing vigilance and cybersecurity measures.