How do you detect BlackCat (ALPHV) ransomware?

Detect BlackCat through the tradecraft and host changes documented in public reporting, since its Rust binaries evade many signatures. Alert on fsutil enabling remote symbolic link evaluation and registry changes raising the SMB MaxMpxCt value, remote service installation or PsExec spread, shadow copy and bcdedit changes, event log clearing and exfiltration tooling before encryption. Chain two or more of these on one host within an hour for high confidence. Cover ESXi through esxcli kill commands in shell.log and Linux through auditd, and keep any recovered command line intact for responders.

Detecting BlackCat (ALPHV): Documented TTPs and Rust Encryptor Behaviours

BlackCat, also called ALPHV, was a ransomware-as-a-service family written in Rust, with builds for Windows, Linux and ESXi. The FBI disrupted the group’s operations in late 2023. Reporting from vendors and the FBI describes an operator-driven encryptor configured by command-line options and an embedded configuration, preceded by hands-on-keyboard tradecraft. We detect that tradecraft and the host changes the encryptor makes, since Rust binaries defeat many traditional signatures.

Signals at a Glance

Signal	Where	ATT&CK
Encryptor launched with operator-supplied command-line options, including an access token	Process creation	T1059
fsutil behavior set SymlinkEvaluation to allow remote symbolic links	Process creation	T1059.003
Registry change raising the SMB server MaxMpxCt value	Registry events, process creation	T1112
PsExec or WMI used to run the encryptor on many hosts	Security 7045, process creation	T1569.002
Shadow copy deletion, bcdedit recovery changes and service kills	Process creation	T1490
Event log clearing before or after encryption	Security 1102, System 104	T1070.001
Exfiltration with a custom data-theft tool and cloud-sync utilities	Proxy, EDR network	T1567

Host Changes Worth Alerting On

Public analyses of BlackCat intrusions describe the encryptor, or the operator before it runs, changing file-system and SMB settings to improve reach and speed. Two changes recur in reporting: enabling remote-to-local and remote-to-remote symbolic link evaluation with fsutil, and raising the SMB maximum multiplexed requests value in the registry. Both are rare in normal administration. Validate the exact command lines against your own telemetry before deploying:

index=sysmon (EventCode=1 OR EventCode=13)
    ( (EventCode=1 Image="*\\fsutil.exe" CommandLine="*SymlinkEvaluation*" (CommandLine="*R2L:1*" OR CommandLine="*R2R:1*"))
   OR (EventCode=1 CommandLine="*LanmanServer\\Parameters*" CommandLine="*MaxMpxCt*")
   OR (EventCode=13 TargetObject="*LanmanServer\\Parameters\\MaxMpxCt*") )
| stats count values(CommandLine) as cmds values(TargetObject) as regkeys by host, User, ParentImage
| sort - count
# tune/validate: confirm field names in your Sysmon pipeline; low legitimate volume expected.

Add a chain query for the broader pre-encryption pattern, because these tuning commands usually accompany shadow copy and recovery changes and propagation by PsExec. Combining any two of the following on one host within an hour makes a high-confidence alert:

fsutil symbolic-link evaluation changes or SMB MaxMpxCt changes.
Shadow copy deletion, bcdedit recovery changes or backup catalog deletion.
A service installed remotely with a random name that points to an executable in a temp path or admin share (System 7045, with PsExec as the typical source).
Event log clearing by a non-system account.

Cross-Platform Coverage

The Rust code base lets operators ship one family across Windows, Linux and ESXi, so cover each platform with the behaviours that apply to it rather than the binary:

Windows: use the chain above, plus exfiltration tooling and cloud-sync clients on file servers before encryption.
ESXi: reporting describes use of esxcli to enumerate and force-stop VMs before encryption, so alert on those commands from shell.log and on SSH enablement. See the ESXi page for logging.
Linux: alert on ELF execution from temp directories, recursive permission changes and file rewrite bursts through auditd.
Access tokens and options: if responders recover a command line, keep it intact. It frequently identifies the affiliate’s build and scope, and helps scoping and negotiation.

Vetted sources

Use the FBI and CISA #StopRansomware advisories on BlackCat/ALPHV and vendor analyses from the major security research teams for tradecraft, SigmaHQ, Elastic and Splunk ESCU for the generic behaviours, and MITRE ATT&CK for mappings. This page lists no hashes, addresses or domains; use vetted feeds for current indicators, validate command-line strings against telemetry and baseline your environment.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Host Changes Worth Alerting On

Cross-Platform Coverage

Build Detections That Fire

Endpoint Ransomware Detection

Detection Hub

LockBit Artifacts and TTPs

ESXi Ransomware Detection