MITRE ATT&CKsoftware (malware)

S1068 BlackCat

Published 2023-02-28 Modified 2025-10-21 Official page ↗
Domain
enterprise
Platforms
Linux, Windows
Aliases
ALPHV, Noberus
Version
1.1
Created
2023-02-28

Description

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.

Related

Uses · MITRE ATT&CK (21)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1680 Local Storage Discovery technique
  • T1570 Lateral Tool Transfer technique
  • T1059.003 Windows Command Shell sub-technique
  • T1069.002 Domain Groups sub-technique
  • T1087.002 Domain Account sub-technique
  • T1491.001 Internal Defacement sub-technique
  • T1561.001 Disk Content Wipe sub-technique
  • T1222.001 Windows Permissions sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1490 Inhibit System Recovery technique
  • T1489 Service Stop technique
  • T1486 Data Encrypted for Impact technique
  • T1134 Access Token Manipulation technique
  • T1135 Network Share Discovery technique
  • T1018 Remote System Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (1)

  • G1015 Scattered Spider group

References