Last week, the head members of the BlackCat/ALPHV ransomware gang pulled off what is now looking like an apparent exit scam. The gang announced that they were shutting down their operation because of “the feds” and that they were in the process of finalizing negotiations to sell their source code. Additionally, the ransomware gang replaced their website with a fake law enforcement seizure notice. Some of the law enforcement agencies listed on the fake banner have already denied any involvement in recent BlackCat disruptions. BlackCat was widely successful in 2023 but eventually became the victim of a joint law enforcement operation that led to the takedown of their infrastructure in December. The gang has been struggling to stay afloat since then, trying hard to instill confidence in their criminal affiliates and successfully restore their operation after the takedown. Efforts seemed to have dwindled, however, with the gang’s leaders likely looking to make an exit which would be well timed following the attack on Change Healthcare last month. A few days after closing down operations, a claim emerged from one (1) of the affiliates complaining that their account had been shut off by the ALPHV leaders right after receiving the $22 million alleged ransom payout they had made from the Change Healthcare attack. Despite an elaborate plan to blame the shutdown on law enforcement while running off with the profits of one last big attack, it doesn’t seem like anyone was quite believing them. A spokesperson for the group eventually came out saying there is “no point in making excuses” followed by one of the forum’s administrators in charge of arbitrating disputes writing “this is an exit scam.” This likely won’t be the end for the group, however, who has disappeared and rebranded countless times. The threat actors first started out as DarkSide back in August 2020 before being shut down after their attack on Colonial Pipeline, and then rebranded as BlackMatter before being shut down again by law enforcement and eventually becoming BlackCat/ALPHV.