BlackCat

Malware
77 incidents First seen 2026-04-21 Last seen 2026-10-31
Also known as
ALPHVNoberus
Overview

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 210 23 techniques 1 groups use it LinuxWindows in ATT&CK since 2023-02-28 updated 2025-10-21 · v1.1
Activity by month (incidents)
2025-052026-10
Sectors targeted
finance · 20health · 20manufacturing · 9hospitality · 8government · 7retail · 7technology · 7cryptocurrency · 4energy · 4maritime · 3
Countries targeted
US · 47CA · 44GB · 19DE · 13UA · 13GE · 12BE · 11CH · 11NL · 11AT · 10ES · 8IT · 8
Origin
US · 19CA · 17GB · 10RU · 6AT · 5AU · 5
Kinds of incident
Ransomware & Extortion · 56Law Enforcement · 25Data Breach · 11Malware & Botnets · 8Industry & Policy · 5Cyberattack (general) · 4
Techniques seen in incidents
Ransomware · 74Extortion · 53Phishing · 15Exfiltration · 10T1588.001 - Malware · 10Data Leak · 9Data Breach · 8Reconnaissance · 7T1059.001 - PowerShell · 7Lateral Movement · 6Social Engineering · 5T1059.007 - JavaScript · 5Credential Stuffing · 4Ddos · 4
Related actors
Scattered Spider · 6The Gentlemen · 4ShinyHunters · 3BlackByte · 2INC Ransom · 2NoName057(16) · 2APT28 · 1Akira · 1
Related CVEs
CVE-2020-0796 · 1CVE-2020-3259 · 1CVE-2023-20269 · 1CVE-2023-3519 · 1CVE-2023-48788 · 1CVE-2024-34102 · 1CVE-2024-57727 · 1CVE-2025-20333 · 1CVE-2025-20362 · 1CVE-2025-3248 · 1
ATT&CK techniques by tactic (23)
execution T1047 Windows Management Instrumentation T1059.003 Windows Command Shell
persistence T1112 Modify Registry
privilege escalation T1134 Access Token Manipulation T1548.002 Bypass User Account Control
discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1135 Network Share Discovery T1680 Local Storage Discovery
lateral movement T1570 Lateral Tool Transfer
impact T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491.001 Internal Defacement T1561.001 Disk Content Wipe
defense impairment T1112 Modify Registry T1222.001 Windows Permissions T1685.005 Clear Windows Event Logs
stealth T1134 Access Token Manipulation
Groups that use it
Scattered Spider
Incident timeline
2026-10-31
Ransomware Live Ransomware Live Ransomware Live HIPAA Journal Ransomware Live Ransomware Live Infosecurity-Magazine AlienVault OTX Ransomware Live Ransomware Live BleepingComputer Ransomware Live Ransomware Live Ransomware Live Ransomware Live Ransomware Live Ransomware Live Ransomware Live Chosun Economy Ransomware Live Ransomware Live Ransomware Live Ransomware Live AlienVault OTX Ransomware Live Ransomware Live Ransomware Live AlienVault OTX AlienVault OTX AlienVault OTX
2026-10-30
The Register - CSO BleepingComputer The Hacker News Cybersecurity Dive Dailysecu AlienVault OTX HackRead
2026-10-30
HIPAA Journal
2026-10-28
Unwrapping Retail Peak Season Cyber Threats
Palo Alto
2026-10-22
Security Affairs
2026-10-21
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Infosecurity-Magazine
2026-10-21
Infosecurity-Magazine Infosecurity-Magazine Infosecurity-Magazine Chosun Economy Data Breaches DB Digest Dailysecu SecurityWeek
2026-10-12
Prominent Ransomware Negotiator Faces Extortion Charges
Dark Reading
2026-10-02
Is It Fair to Blame 'Rogue' AI for Security Failures?
Dark Reading
2026-09-28
AlienVault OTX Infosecurity-Magazine
2026-09-28
AlienVault OTX The Hacker News AlienVault OTX
2026-09-22
Infosecurity-Magazine AlienVault OTX AlienVault OTX AlienVault OTX Kaspersky
2026-09-11
Conti ransomware gang member sentenced to 4 years in prison
BleepingComputer
2026-08-26
Red Flags That Expose Fake North Korean IT Workers
Dark Reading
2026-07-22
Japanese food logistics giant recovers as extortion group claims cyberattack
TheRecord
2026-07-21
The Hacker News BleepingComputer Infosecurity-Magazine
2026-07-14
The inside job that cost ransomware victims millions
Malware Bytes
2026-07-11
Ransomware negotiator who conspired with BlackCat threat actors sentenced to 70 months in prison
Data Breaches
2026-07-10
Ryuk operator pleads guilty; Blackcat/AlphV conspirator gets nearly 6-year sentence
TheRecord
2026-07-10
Cybersecurity Negotiator Gets 70 Months for Helping BlackCat Extort Victims
HackRead
2026-07-10
Former Ransomware Negotiator Sentenced to 70 Months in Prison for Secretly Helping BlackCat Gang
Security Affairs
2026-07-10
BleepingComputer
2026-07-10
Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks
The Hacker News
2026-07-10
Former DigitalMint ransomware negotiator who duped clients sentenced to 70 months in jail
CyberScoop
2026-07-03
Qilin Dominates Ransomware Market Amid Growing Cybercrime Consolidation
Infosecurity-Magazine
2026-06-18
The Hacker News Dark Reading
2026-06-16
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
The Hacker News
2026-06-16
'Lorem Ipsum' Malware Pivots to ClickFix Delivery
Dark Reading
2026-06-13
HackRead HackRead
2026-06-12
Ukrainian national pleads guilty to role in Conti ransomware operation
Data Breaches
2026-06-03
Change Healthcare llega a pagar 22 millones de dólares por un ciberataque para recuperar información médica protegida
Bit Life Media
2026-05-28
Palo Alto Palo Alto
2026-05-19
WantToCry ransomware remotely encrypts files
Sophos News
2026-05-18
Kaspersky Kaspersky
2026-05-14
CyberScoop
2026-05-13
BleepingComputer
2026-05-05
Karakurt extortion gang ‘cold case’ negotiator gets 8.5 years in prison
BleepingComputer
2026-05-02
Two US cybersecurity experts sentenced in ransomware case, third awaits July ruling
Security Affairs
2026-05-02
2 US Cybersecurity Experts Jailed for Aiding ALPHV (BlackCat) Ransomware
HackRead
2026-05-01
Cyber incident responders who carried out ransomware attacks given 4-year sentences
TheRecord
2026-05-01
Two American Cybersecurity Workers Jailed for BlackCat Ransomware Attacks
Infosecurity-Magazine
2026-05-01
Two American Cybersecurity Workers Jailed for BlackCat Ransomware Attacks
Infosecurity-Magazine
2026-05-01
The Hacker News
2026-05-01
US ransomware negotiators get 4 years in prison over BlackCat attacks
BleepingComputer
2026-04-30
Former incident responders sentenced to 4 years in prison for committing ransomware attacks
CyberScoop
2026-04-23
It pays to be a forever student
Talos Intelligence
2026-04-22
Former Ransomware Negotiator Pleads Guilty to Working For BlackCat Cyber Gang
Infosecurity-Magazine
2026-04-22
Former Ransomware Negotiator Pleads Guilty to Working For BlackCat Cyber Gang
Infosecurity-Magazine
2026-04-21
Ransomware Negotiator Pleads Guilty to BlackCat Scheme
Dark Reading
2026-04-21
Former DigitalMint ransomware negotiator pleads guilty to extortion scheme
CyberScoop