Rewards For Justice (RFJ), a U.S. government interagency rewards program. Offers up to $10 million reward for any information that could lead to the identification or location of any person from the ALPHV cyber gang, also known as BlackCat, who attacks U.S. critical infrastructure.

The reward offered by the intelligence-driven law enforcement government program is similar to what the RFJ provides for information about high-profile Yemeni and Saudi terrorist elements and al-Qa’ida members.

Targeting critical infrastructure and the change healthcare attack

The U.S. government takes attacks on critical infrastructure very seriously. As such activities violate the Computer Fraud and Abuse Act (CFAA). RFJ’s sudden attention to the cyber gang is likely a response to the recent cyberattack on UnitedHealth’s sub-company Change Healthcare. Affiliates of the hacker organization stole approximately six terabytes of data during a security incident earlier this year.

Change Healthcare operates the largest financial and administrative information exchange in the United States and was hit by bad actors in February 2024. The attack was massive and disruptive, with some partner healthcare providers claiming to lose upwards of $100 million per day because of the breach. Even though many believe UnitedHealth paid a $22 million ransom to the hackers, the health insurance company is still dealing with the fallout after the attack and is working on processing over $14 billion in claims.

BlackCat: A RaaS gang behind major attacks

BlackCat, also known as ALPHV and Noberus, is a ransomware-as-a-service (RaaS) cyber gang. And it has been somehow connected to some of the most significant ransomware attacks over the last few years. The popular cyber gang provides its ransomware malicious code to affiliates, who then attack organizations for monetary gain. Affiliates of the popular cyber gang were behind the attack on Reddit and the breaches of MGM Resorts International and Caesars Entertainment.

In an eyebrow-raising twist, the affiliates responsible for the UnitedHealth heist might have been scammed out of the money themselves. As soon after BlackCat confirmed receipt of the $22 million ransom, decided to pull an exit scam and run away with the digital funds, as the group now displays a fake banner saying that the FBI and other criminal agencies have seized the server. Usually, after a victim pays a ransom, the BlackCat gang splits the money with the affiliates who executed the attack. But in this case, the BlackCat decided not to split the payment and move on with their lives. Essentially scamming the people who pulled out the heist.

Read also: FBI makes a move against ALPHV/Blackcat, the cybergang fights back

Unmasking BlackCat: RFJ seeks information

The location of the gang leaders and the affiliates associated with the attack remains unknown. U.S. government agencies hope that the $10 million reward offered by RFJ will help law enforcement agencies finally have a breakthrough on the criminal organization. Organization that has been torturing both government and private organizations in the U.S. and abroad for years.

The scope of the hacker organization’s attacks is so massive and sophisticated. Because of that, RFJ believes the RaaS organization is likely acting under the direction or control of a foreign government. However, the RFJ reward notice does not name specific countries that could be supporting the ALPHV BlackCat hacker group.