On June 13, 2022, Microsoft released a report detailing that ALPHV (aka BlackCat and Noberus) ransomware affiliates are targeting Microsoft Exchange servers by exploiting unpatched vulnerabilities. While Microsoft did not specify which vulnerabilities are currently being exploited, an advisory was linked in their report that mentions four (4) Microsoft Exchange Server zero-day flaws that were being exploited in 2021: CVE-2021-26855, CVE-2021-26858, CVE-2021-26857, and CVE-2021-27065 (all associated to ProxyLogon). This linkage can provide some context for what should still be monitored today, as threat actors still capitalize on organizations that do not implement security patches frequently. Microsoft also detailed that “two of the most prolific” affiliate groups are distributing ALPHV at this time: DEV-0237 (AKA FIN12) and DEV-0504. DEV-0237 is known for previously deploying Ryuk, Conti, and Hive, and was last seen targeting the healthcare sector in October 2021. DEV-0504 previously deployed Ryuk, REvil, LockBit 2.0, BlackMatter, and Conti, and has a history of targeting the fashion, tobacco, manufacturing, and IT industries. The most recent deployment of ALPHV ransomware by DEV-0504 was against the energy sector in January 2022. Microsoft researchers noted that in one (1) recently observed instance, an affiliate deployed the ALPHV malware payloads via PsExec two (2) weeks after gaining initial access. This payload delivery was at the conclusion of the common threat actor attack chain, which includes initial access, discovery of system and network information, credential theft, lateral movement into additional devices remotely, data exfiltration, and lastly malware deployment and double extortion. ALPHV typically targets and encrypts both Windows and Linux machines as well as VMware instances. The impact of this ransomware continues to affect North and South America, Europe, Asia, and Africa, and as ALPHV continues to be a Ransomware-as-a-Service (RaaS) operation, the scope of target locations is predicted to grow as new affiliates join.