Threat intelligence / Malware

BlackCat

[BlackCat](https://attack.mitre.org/software/S1068) is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, [BlackCat](https://attack.mitre.org/software/S1068) has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)(Citation: ACSC BlackCat Apr 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BlackCat](https://attack.mitre.org/software/S1068) is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, [BlackCat](https://attack.mitre.org/software/S1068) has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)(Citation: ACSC BlackCat Apr 2022)

Labels

malware

22 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to Bypass User Account Control

Technique

uses

to Clear Windows Event Logs

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Disk Content Wipe

Technique

uses

to Domain Account

Technique

uses

to Domain Groups

Technique

uses

to File and Directory Discovery

Technique

uses

to Inhibit System Recovery

Technique

uses

to Internal Defacement

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Modify Registry

Technique

uses

to Network Share Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to Service Stop

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Permissions

Technique

uses

from Scattered Spider

Group

6 external

References

mitre-attack

S1068

Noberus

—

ALPHV

—

ACSC BlackCat Apr 2022

https://www.cyber.gov.au/about-us/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat

Sophos BlackCat Jul 2022

https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/

Microsoft BlackCat Jun 2022

https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/