AlphV/BlackCat Ransomware Network Connection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.