Home › Threat Actors › Cicada3301
← All Threat Actors
Cybercrime critical Eastern Europe (Russia-linked, assessed)

Cicada3301

Ransomware-as-a-Service (RaaS) — ALPHV/BlackCat successor (assessed) · Financial — ransomware and extortion

Reports 1
Active Since 2024
Last Reported 1 Jul 2026
Sectors Targeted finance, healthcare, legal-professional, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Rust-based cross-platform encryptor with strong technical and code-level similarities to ALPHV/BlackCat
  • ChaCha20 encryption with RSA-OAEP key encapsulation — same construction as ALPHV
  • Intermittent encryption for large files: accelerates completion, reduces detection window before encryption is complete
  • VMware ESXi specialist — enumerates VMs via esxcli/vim-cmd, terminates workloads, encrypts VMDK files
  • Configurable per-victim encryption parameters and file extension via affiliate builder
  • Initial access via VPN credential theft and exposed remote services
  • 20% core team commission / 80% affiliate split — standard major RaaS structure

Known Targets

Manufacturing and logisticsHealthcare organisationsFinancial servicesEuropean enterprisesVMware ESXi-virtualised environments globally

Analyst Notes

Cicada3301 (Repellent Scorpius, Unit 42) emerged May 2024 — two months after the ALPHV/BlackCat collapse. The technical similarities are significant: both written in Rust, both use ChaCha20+RSA-OAEP encryption, near-identical ESXi targeting logic, and similar configuration file structures. Unit 42 assessed Cicada3301 as either a direct successor or a group with access to ALPHV source code or a significant ALPHV developer. ESXi targeting remains the most operationally significant capability — a single ESXi host compromise can encrypt dozens of virtual servers simultaneously.

Also Known As

Repellent Scorpius (Palo Alto Unit 42 designation)

MITRE ATT&CK Techniques

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1059 Command and Scripting Interpreter T1041 Exfiltration Over C2 Channel T1562.001 Impair Defenses: Disable or Modify Tools

Intelligence Reports

Analysis financehealthcare

Cicada3301: The Rust-Based RaaS That Emerged From the ALPHV Collapse

Cicada3301, tracked by Palo Alto Unit 42 as Repellent Scorpius, emerged in mid-2024 as a technically sophisticated ransomware-as-a-service operation bearing strong similarities to the ALPHV/BlackCat platform. This deep dive examines the evidence for an ALPHV connection, the technical profile of the Rust-based encryptor, targeting patterns, and what the group's structure tells us about resilience in the ransomware ecosystem.

1 Jul 2026 · 14 min read