Blackcat ransomware organization, otherwise known as ALPHAV, is a newly emerging threat group first seen in the wild in November 2021. These threat actors discovered only months ago have made a significant name for themselves and have a reputation for double ransom attacks; holding the target’s infrastructure and exfiltrated files for a significant ransom. While Blackcat targets entities worldwide, roughly 30% of their attacks occur against United States-based corporations. There has been speculation surrounding the group in recent months, alluding to Blackcat being a rebrand of the BlackMatter/DarkSide threat organization. However, security researchers believe that Blackcat is more of a home for threat actors from numerous ransomware-as-a-service affiliates. There have been connections made between the Blackcat and BlackMatter ransomware groups, including a domain and IP address used by BlackMatter actors during a cyberattack in September 2021. Deeper analysis of this connection revealed commonalities between ransomware variants’ tactics, such as tools, file naming structure, and deployment techniques. While Blackcat is still new to the threat landscape, their backbone actors have been working for significantly longer with other affiliates. CTIX analysts believe that regardless of seniority, Blackcat is a threat group not to be taken lightly and will most likely continue their campaigns in the months to come.