BlackCat
Associated Software Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1548 | .002 | Abuse Elevation Control Mechanism:Bypass User Account Control | |
| Enterprise | T1134 | Access Token Manipulation | ||
| Enterprise | T1087 | .002 | Account Discovery:Domain Account | BlackCat can utilize |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter:Windows Command Shell | BlackCat can execute commands on a compromised network with the use of |
| Enterprise | T1486 | Data Encrypted for Impact | BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances.[1] | |
| Enterprise | T1491 | .001 | Defacement:Internal Defacement | BlackCat can change the desktop wallpaper on compromised hosts.[1][2] |
| Enterprise | T1561 | .001 | Disk Wipe:Disk Content Wipe | BlackCat has the ability to wipe VM snapshots on compromised networks.[1][2] |
| Enterprise | T1083 | File and Directory Discovery | ||
| Enterprise | T1222 | .001 | File and Directory Permissions Modification:Windows File and Directory Permissions Modification | BlackCat can use Windows commands such as |
| Enterprise | T1070 | .001 | Indicator Removal:Clear Windows Event Logs | |
| Enterprise | T1490 | Inhibit System Recovery | BlackCat can delete shadow copies using | |
| Enterprise | T1570 | Lateral Tool Transfer | BlackCat can replicate itself across connected servers via | |
| Enterprise | T1680 | Local Storage Discovery | ||
| Enterprise | T1112 | Modify Registry | BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: | |
| Enterprise | T1135 | Network Share Discovery | BlackCat has the ability to discover network shares on compromised networks.[1][2] | |
| Enterprise | T1069 | .002 | Permission Groups Discovery:Domain Groups | BlackCat can determine if a user on a compromised host has domain admin privileges.[1] |
| Enterprise | T1018 | Remote System Discovery | BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.[1] | |
| Enterprise | T1489 | Service Stop | BlackCat has the ability to stop VM services on compromised networks.[1][2] | |
| Enterprise | T1082 | System Information Discovery | ||
| Enterprise | T1033 | System Owner/User Discovery | BlackCat can utilize | |
| Enterprise | T1047 | Windows Management Instrumentation | BlackCat can use | |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G1015 | Scattered Spider | Scattered Spider has deployedBlackCat ransomware to victim environments for financial gain.[4][5][6][7] |
References
- Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
- Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.
- Australian Cyber Security Centre. (2022, April 14). 2022-004: ACSC Ransomware Profile - ALPHV (aka BlackCat). Retrieved December 20, 2022.
- CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
- Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.
- Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.
- Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.