BlackCat

Malware & Tools · BlackCat

· MalwareS1068 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Linux, Windows

Description

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)(Citation: ACSC BlackCat Apr 2022)

Tactic Coverage

discovery (8)impact (5)defense impairment (3)execution (2)privilege escalation (2)persistence (1)stealth (1)lateral movement (1)

Used By (1 groups)

G1015Scattered SpiderRoasted 0ktapus, Octo Tempest

Techniques (21)

T1018Remote System Discovery

discovery

T1033System Owner/User Discovery

discovery

T1047Windows Management Instrumentation

execution

T1059.003Windows Command Shell

execution

T1069.002Domain Groups

discovery

T1082System Information Discovery

discovery

T1083File and Directory Discovery

References

https://attack.mitre.org/software/S1068 https://www.cyber.gov.au/about-us/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/