BlackCat

Also known as: ALPHV, ALPHVM, Ambitious Scorpius, BlackCat, BlackCat Gang, Noberus, UNC4466, blackcat_raas

BlackCat (ALPHV) is ransomware written in Rust. The ransomware makes heavy use of plaintext JSON configuration files to specify the ransomware functionality. BlackCat has many advanced capabilities like escalating privileges and bypassing UAC make use of AES and ChaCha20 or Salsa encryption, may use the Restart Manager, can delete volume shadow copies, can enumerate disk volumes and network shares automatically, and may kill specific processes and services. The ransomware exists for both Windows, Linux, and ESXi systems. Multiple extortion techniques are used by the BlackCat gang, such as exfiltrating victim data before the ransomware deployment, threats to release data if the ransomw is not paid, and distributed denial-of-service (DDoS) attacks.

🌍 Country ["[Unknown]"]

Associated Operations

2021-12 2022-01 2022-02 2022-04 2022-05 2022-06 2022-07 2022-08 2022-09 2022-10 2022-12 2023-01 2023-02 2023-03 2023-04 2023-05 2023-06 2023-07 2023-08 2023-09 2023-10 2023-11 2023-12 2024-01 2024-02 2024-03 5M in Demands AIT-Thailand ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access ALPHV gang claims ransomware attack on Constellation Software ALPHV ransomware adds data leak API in new extortion strategy ALPHV ransomware claims loanDepot ALPHV ransomware gang claims attack on Florida circuit court Advarra hacked AlphV claims an attack before even alerting the victim. How will that work out for them? AlphV files an SEC complaint against MeridianLink for not disclosing a breach to the SEC AlphV group takes credit for ransomware attack on Georgia county AlphV reacts to law enforcement action by allowing affiliates to attack hospitals Alphv group claims the hack of Clarion Amazon-owned Ring denies ‘ransomware event’ following darknet listing Another small firm suffers a serious ransomware attack: Cadre Services gets mauled by AlphV Australian Law Firm Hack Affected 65 Government Agencies Austrian federal state Carinthia has been hit by the BlackCat ransomware gang Bandai Namco confirms hack after ALPHV ransomware data leak threat Bangladesh government website leaks citizens’ personal data BlackCat BlackCat (ALPHV) claims Swissport ransomware attack BlackCat (aka ALPHV) Ransomware is Increasing Stakes up to $2 BlackCat Adds Indian Missile Fuel Maker to Its Victims List BlackCat Attacks University of Pisa BlackCat Climbs the Summit With a New Tactic BlackCat ransomware claims breach of healthcare giant Henry Schein BlackCat ransomware fails to extort Australian commercial law giant BlackCat ransomware hits Azure Storage with Sphynx encryptor BlackCat ransomware implicated in attack on German oil companies BlackCat ransomware shuts down in exit scam BlackCat said they breached US Department of Defense contractor and went offline Clop claim ransomware attack on cosmetics maker Estée Lauder Colombian energy supplier EPM hit by BlackCat ransomware attack Demands $4.5M Ransom Fashion giant Moncler confirms data breach after ransomware attack Global IT services provider Inetum hit by ransomware attack HTC Global Services confirms cyberattack after data leaked online Henry Schein re-encrypted by BlackCat again Hessen Consumer Center says systems encrypted by ransomware Hive If at first you don’t succeed Indian pharmaceutical giant warns of revenue loss Japanese watchmaker Seiko breached by BlackCat ransomware gang Large Michigan healthcare provider confirms ransomware attack Legal services platform used by SEC Lockbit Louisiana authorities investigating ransomware attack on city of Alexandria Major airline technology provider Accelya attacked by ransomware group McLaren Health Care says data breach impacted 2.2 million people Microsoft: BlackCat's Sphynx ransomware embeds Impacket Motel One discloses data breach following ransomware attack NCAT State University Norton Healthcare discloses data breach after May ransomware attack Notorious ransomware gang takes credit for cyberattack on Fidelity National Financial Now BlackCat extortionists threaten to leak stolen plastic surgery pics Pennsylvania Health System CEO Confirms BlackCat Attack Pentagon investigating ransomware attack claims Product leasing giant warns that sensitive information was stolen during cyberattack Prudential Financial breaches Ransomware gang cloned victim’s website to leak stolen data Ransomware gang creates site for employees to search for their stolen data Ransomware gang posts breast cancer patients’ clinical photographs Reddit hackers threaten to leak data stolen in February breach RemCom String of cyberattacks on European oil and chemical sectors likely not coordinated The ALPHV ransomware gang The Alphv ransomware gang stole 5TB of data from the Morrison Community Hospital The BlackCat Ransomware group claims to have hacked SOLAR INDUSTRIES INDIA and to have stolen 2TB of “secret military data.” The BlackCat/ALPHV ransomware gang claimed responsibility for an attack that hit the systems of Italy's energy agency Gestore dei Servizi Energetici SpA (GSE) over the weekend. The big bad BlackCat tries to bully Hampton-Newport News CSB. Shame on BlackCat. Toy maker Jakks Pacific reports cyberattack after multiple ransomware groups leak data Trans-Northern Pipelines investigating ALPHV ransomware attack claims UnitedHealth subsidiary Optum hack linked to BlackCat ransomware a global manufacturer of audio and video equipment for cars a natural gas pipeline and electricity network operator in the central European country. aka BlackCat also known as ALPHV and BlackCat attack automotive supplier in triple ransomware attack and the largest natural gas supplier in Latin America - TGS believed a rebranded version of the BlackMatter or DarkSide ransomware group blames the 'feds' claimed responsibility for a cyberattack against Creos Luxembourg S.A. last week critical infrastructure has claimed to have successfully targeted several organizations including a popular Nigerian betting platform Bet9ja https://cybernews.com/news/blackcat-breached-department-of-defense-contractor-went-offline/ https://news.sophos.com/en-us/2022/08/10/lockbit-hive-and-blackcat-attack-automotive-supplier-in-triple-ransomware-attack/ https://resecurity.com/blog/article/blackcat-aka-alphv-ransomware-is-increasing-stakes-up-to-25m-in-demands https://securityaffairs.com/141409/data-breach/blackcat-ransomware-solar-industries-india.html https://securityaffairs.com/151299/data-breach/alphv-ransomware-hacked-clarion.html https://securityaffairs.com/152486/cyber-crime/alphv-ransomware-morrison-community-hospital.html https://techcrunch.com/2023/07/07/bangladesh-government-website-leaks-citizens-personal-data/> https://therecord.media/blackcat-clop-claim-cyberattack-on-estee-lauder https://therecord.media/casepoint-legal-tech-platform-investigating-ransomware-attack-claims-blackcat https://therecord.media/fidelity-national-financial-ransomware-alphv-black-cat https://therecord.media/forsyth-county-georgia-ransomware-alphv-post https://therecord.media/louisiana-authorities-investigating-ransomware-attack-on-city-of-alexandria/ https://therecord.media/major-airline-technology-provider-accelya-attacked-by-ransomware-group/ https://therecord.media/mclaren-healthcare-ransomware-attack-michigan https://therecord.media/product-leasing-giant-progressive-ransomware https://therecord.media/ransomware-lehigh-valley-alphv-black-cat https://therecord.media/ring-denies-ransomware-attack-alphv https://therecord.media/string-of-cyberattacks-on-european-oil-and-chemical-sectors-likely-not-coordinated-officials-say/ https://therecord.media/sun-pharma-india-ransomware-attack https://therecord.media/toy-maker-jakks-pacific-reports-cyberattack-after-multiple-ransomware-groups-post-stolen-data/ https://unit42.paloaltonetworks.com/blackcat-ransomware-releases-new-utility-munchkin/ https://www.bankinfosecurity.com/australian-law-firm-hack-affected-65-government-agencies-a-23110 https://www.bankinfosecurity.com/blackcat-adds-indian-missile-fuel-maker-to-its-victims-list-a-21089 https://www.bankinfosecurity.com/blackcat-attack-on-betting-company-disrupts-service-a-18886 https://www.bankinfosecurity.com/blackcat-attacks-university-pisa-demands-45m-ransom-a-19338 https://www.bankinfosecurity.com/pennsylvania-health-system-ceo-confirms-blackcat-attack-a-21279 https://www.bleepingcomputer.com/news/microsoft/microsoft-blackcats-sphynx-ransomware-embeds-impacket-remcom/ https://www.bleepingcomputer.com/news/security/alphv-gang-claims-ransomware-attack-on-constellation-software/ https://www.bleepingcomputer.com/news/security/alphv-ransomware-adds-data-leak-api-in-new-extortion-strategy/ https://www.bleepingcomputer.com/news/security/alphv-ransomware-claims-loandepot-prudential-financial-breaches/ https://www.bleepingcomputer.com/news/security/alphv-ransomware-gang-claims-attack-on-florida-circuit-court/ https://www.bleepingcomputer.com/news/security/bandai-namco-confirms-hack-after-alphv-ransomware-data-leak-threat/ https://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/ https://www.bleepingcomputer.com/news/security/blackcat-alphv-ransomware-asks-5-million-to-unlock-austrian-state/ https://www.bleepingcomputer.com/news/security/blackcat-ransomware-claims-attack-on-european-gas-pipeline/ https://www.bleepingcomputer.com/news/security/blackcat-ransomware-claims-attack-on-italian-energy-agency/ https://www.bleepingcomputer.com/news/security/blackcat-ransomware-claims-breach-of-healthcare-giant-henry-schein/ https://www.bleepingcomputer.com/news/security/blackcat-ransomware-fails-to-extort-australian-commercial-law-giant/ https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azure-storage-with-sphynx-encryptor/ https://www.bleepingcomputer.com/news/security/blackcat-ransomware-shuts-down-in-exit-scam-blames-the-feds/ https://www.bleepingcomputer.com/news/security/blackcat-ransomware-turns-off-servers-amid-claim-they-stole-22-million-ransom/ https://www.bleepingcomputer.com/news/security/colombian-energy-supplier-epm-hit-by-blackcat-ransomware-attack/ https://www.bleepingcomputer.com/news/security/fashion-giant-moncler-confirms-data-breach-after-ransomware-attack/ https://www.bleepingcomputer.com/news/security/global-it-services-provider-inetum-hit-by-ransomware-attack/ https://www.bleepingcomputer.com/news/security/hessen-consumer-center-says-systems-encrypted-by-ransomware/ https://www.bleepingcomputer.com/news/security/htc-global-services-confirms-cyberattack-after-data-leaked-online/ https://www.bleepingcomputer.com/news/security/japanese-watchmaker-seiko-breached-by-blackcat-ransomware-gang/ https://www.bleepingcomputer.com/news/security/mclaren-health-care-says-data-breach-impacted-22-million-people/ https://www.bleepingcomputer.com/news/security/motel-one-discloses-data-breach-following-ransomware-attack/ https://www.bleepingcomputer.com/news/security/norton-healthcare-discloses-data-breach-after-may-ransomware-attack/ https://www.bleepingcomputer.com/news/security/ransomware-gang-cloned-victim-s-website-to-leak-stolen-data/ https://www.bleepingcomputer.com/news/security/ransomware-gang-creates-site-for-employees-to-search-for-their-stolen-data/ https://www.bleepingcomputer.com/news/security/reddit-hackers-threaten-to-leak-data-stolen-in-february-breach/ https://www.bleepingcomputer.com/news/security/trans-northern-pipelines-investigating-alphv-ransomware-attack-claims/ https://www.bleepingcomputer.com/news/security/unitedhealth-subsidiary-optum-hack-linked-to-blackcat-ransomware/ https://www.databreaches.net/almost-everything-you-have-posted-in-your-news-article-about-this-incident-is-a-total-crap-blackcat-to-bangladeshi-news-outlets/ https://www.databreaches.net/alphv-claims-an-attack-before-even-alerting-the-victim-how-will-that-work-out-for-them/ https://www.databreaches.net/alphv-files-an-sec-complaint-against-meridianlink-for-not-disclosing-a-breach-to-the-sec/ https://www.databreaches.net/alphv-reacts-to-law-enforcement-action-by-allowing-affiliates-to-attack-hospitals-critical-infrastructure/ https://www.databreaches.net/another-small-firm-suffers-a-serious-ransomware-attack-cadre-services-gets-mauled-by-alphv/ https://www.databreaches.net/blackcat-attempts-to-up-the-pressure-on-suffolk-county-starts-to-leak-data/ https://www.databreaches.net/exclusive-advarra-hacked-threat-actors-threatening-to-leak-data/ https://www.databreaches.net/henry-schein-re-encrypted-by-blackcat-again/ https://www.databreaches.net/if-at-first-you-dont-succeed-screw-it-up-again/ https://www.databreaches.net/the-big-bad-blackcat-tries-to-bully-hampton-newport-news-csb-shame-on-blackcat/ https://www.mandiant.com/resources/blog/alphv-ransomware-backup https://www.theregister.com/2023/06/22/blackcat_ransomware_plastic_surgery_clinic/ https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/ in the past few days. leaks data litigation after ransomware attack officials say screw it up again? starts to leak data? threat actors threatening to leak data three universities - FIU who demanded a $5 million to unlock the encrypted computer systems. “BlackCat” attempts to up the pressure on Suffolk County

Introduction

BlackCat (ALPHV) is ransomware written in Rust. The ransomware makes heavy use of plaintext JSON configuration files to specify the ransomware functionality. BlackCat has many advanced capabilities like escalating privileges and bypassing UAC make use of AES and ChaCha20 or Salsa encryption, may use the Restart Manager, can delete volume shadow copies, can enumerate disk volumes and network shares automatically, and may kill specific processes and services. The ransomware exists for both Windows, Linux, and ESXi systems. Multiple extortion techniques are used by the BlackCat gang, such as exfiltrating victim data before the ransomware deployment, threats to release data if the ransomw is not paid, and distributed denial-of-service (DDoS) attacks.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2021-12
  • 2022-01
  • 2022-02
  • 2022-04
  • 2022-05
  • 2022-06
  • 2022-07
  • 2022-08
  • 2022-09
  • 2022-10
  • 2022-12
  • 2023-01
  • 2023-02
  • 2023-03
  • 2023-04
  • 2023-05
  • 2023-06
  • 2023-07
  • 2023-08
  • 2023-09
  • 2023-10
  • 2023-11
  • 2023-12
  • 2024-01
  • 2024-02
  • 2024-03
  • 5M in Demands
  • AIT-Thailand
  • ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access
  • ALPHV gang claims ransomware attack on Constellation Software
  • ALPHV ransomware adds data leak API in new extortion strategy
  • ALPHV ransomware claims loanDepot
  • ALPHV ransomware gang claims attack on Florida circuit court
  • Advarra hacked
  • AlphV claims an attack before even alerting the victim. How will that work out for them?
  • AlphV files an SEC complaint against MeridianLink for not disclosing a breach to the SEC
  • AlphV group takes credit for ransomware attack on Georgia county
  • AlphV reacts to law enforcement action by allowing affiliates to attack hospitals
  • Alphv group claims the hack of Clarion
  • Amazon-owned Ring denies ‘ransomware event’ following darknet listing
  • Another small firm suffers a serious ransomware attack: Cadre Services gets mauled by AlphV
  • Australian Law Firm Hack Affected 65 Government Agencies
  • Austrian federal state Carinthia has been hit by the BlackCat ransomware gang
  • Bandai Namco confirms hack after ALPHV ransomware data leak threat
  • Bangladesh government website leaks citizens’ personal data
  • BlackCat
  • BlackCat (ALPHV) claims Swissport ransomware attack
  • BlackCat (aka ALPHV) Ransomware is Increasing Stakes up to $2
  • BlackCat Adds Indian Missile Fuel Maker to Its Victims List
  • BlackCat Attacks University of Pisa
  • BlackCat Climbs the Summit With a New Tactic
  • BlackCat ransomware claims breach of healthcare giant Henry Schein
  • BlackCat ransomware fails to extort Australian commercial law giant
  • BlackCat ransomware hits Azure Storage with Sphynx encryptor
  • BlackCat ransomware implicated in attack on German oil companies
  • BlackCat ransomware shuts down in exit scam
  • BlackCat said they breached US Department of Defense contractor and went offline
  • Clop claim ransomware attack on cosmetics maker Estée Lauder
  • Colombian energy supplier EPM hit by BlackCat ransomware attack
  • Demands $4.5M Ransom
  • Fashion giant Moncler confirms data breach after ransomware attack
  • Global IT services provider Inetum hit by ransomware attack
  • HTC Global Services confirms cyberattack after data leaked online
  • Henry Schein re-encrypted by BlackCat again
  • Hessen Consumer Center says systems encrypted by ransomware
  • Hive
  • If at first you don’t succeed
  • Indian pharmaceutical giant warns of revenue loss
  • Japanese watchmaker Seiko breached by BlackCat ransomware gang
  • Large Michigan healthcare provider confirms ransomware attack
  • Legal services platform used by SEC
  • Lockbit
  • Louisiana authorities investigating ransomware attack on city of Alexandria
  • Major airline technology provider Accelya attacked by ransomware group
  • McLaren Health Care says data breach impacted 2.2 million people
  • Microsoft: BlackCat’s Sphynx ransomware embeds Impacket
  • Motel One discloses data breach following ransomware attack
  • NCAT State University
  • Norton Healthcare discloses data breach after May ransomware attack
  • Notorious ransomware gang takes credit for cyberattack on Fidelity National Financial
  • Now BlackCat extortionists threaten to leak stolen plastic surgery pics
  • Pennsylvania Health System CEO Confirms BlackCat Attack
  • Pentagon investigating ransomware attack claims
  • Product leasing giant warns that sensitive information was stolen during cyberattack
  • Prudential Financial breaches
  • Ransomware gang cloned victim’s website to leak stolen data
  • Ransomware gang creates site for employees to search for their stolen data
  • Ransomware gang posts breast cancer patients’ clinical photographs
  • Reddit hackers threaten to leak data stolen in February breach
  • RemCom
  • String of cyberattacks on European oil and chemical sectors likely not coordinated
  • The ALPHV ransomware gang
  • The Alphv ransomware gang stole 5TB of data from the Morrison Community Hospital
  • The BlackCat Ransomware group claims to have hacked SOLAR INDUSTRIES INDIA and to have stolen 2TB of “secret military data.”
  • The BlackCat/ALPHV ransomware gang claimed responsibility for an attack that hit the systems of Italy’s energy agency Gestore dei Servizi Energetici SpA (GSE) over the weekend.
  • The big bad BlackCat tries to bully Hampton-Newport News CSB. Shame on BlackCat.
  • Toy maker Jakks Pacific reports cyberattack after multiple ransomware groups leak data
  • Trans-Northern Pipelines investigating ALPHV ransomware attack claims
  • UnitedHealth subsidiary Optum hack linked to BlackCat ransomware
  • a global manufacturer of audio and video equipment for cars
  • a natural gas pipeline and electricity network operator in the central European country.
  • aka BlackCat
  • also known as ALPHV
  • and BlackCat attack automotive supplier in triple ransomware attack
  • and the largest natural gas supplier in Latin America - TGS
  • believed a rebranded version of the BlackMatter or DarkSide ransomware group
  • blames the ‘feds’
  • claimed responsibility for a cyberattack against Creos Luxembourg S.A. last week
  • critical infrastructure
  • has claimed to have successfully targeted several organizations including a popular Nigerian betting platform Bet9ja
  • https://cybernews.com/news/blackcat-breached-department-of-defense-contractor-went-offline/
  • https://news.sophos.com/en-us/2022/08/10/lockbit-hive-and-blackcat-attack-automotive-supplier-in-triple-ransomware-attack/
  • https://resecurity.com/blog/article/blackcat-aka-alphv-ransomware-is-increasing-stakes-up-to-25m-in-demands
  • https://securityaffairs.com/141409/data-breach/blackcat-ransomware-solar-industries-india.html
  • https://securityaffairs.com/151299/data-breach/alphv-ransomware-hacked-clarion.html
  • https://securityaffairs.com/152486/cyber-crime/alphv-ransomware-morrison-community-hospital.html
  • https://techcrunch.com/2023/07/07/bangladesh-government-website-leaks-citizens-personal-data/>
  • https://therecord.media/blackcat-clop-claim-cyberattack-on-estee-lauder
  • https://therecord.media/casepoint-legal-tech-platform-investigating-ransomware-attack-claims-blackcat
  • https://therecord.media/fidelity-national-financial-ransomware-alphv-black-cat
  • https://therecord.media/forsyth-county-georgia-ransomware-alphv-post
  • https://therecord.media/louisiana-authorities-investigating-ransomware-attack-on-city-of-alexandria/
  • https://therecord.media/major-airline-technology-provider-accelya-attacked-by-ransomware-group/
  • https://therecord.media/mclaren-healthcare-ransomware-attack-michigan
  • https://therecord.media/product-leasing-giant-progressive-ransomware
  • https://therecord.media/ransomware-lehigh-valley-alphv-black-cat
  • https://therecord.media/ring-denies-ransomware-attack-alphv
  • https://therecord.media/string-of-cyberattacks-on-european-oil-and-chemical-sectors-likely-not-coordinated-officials-say/
  • https://therecord.media/sun-pharma-india-ransomware-attack
  • https://therecord.media/toy-maker-jakks-pacific-reports-cyberattack-after-multiple-ransomware-groups-post-stolen-data/
  • https://unit42.paloaltonetworks.com/blackcat-ransomware-releases-new-utility-munchkin/
  • https://www.bankinfosecurity.com/australian-law-firm-hack-affected-65-government-agencies-a-23110
  • https://www.bankinfosecurity.com/blackcat-adds-indian-missile-fuel-maker-to-its-victims-list-a-21089
  • https://www.bankinfosecurity.com/blackcat-attack-on-betting-company-disrupts-service-a-18886
  • https://www.bankinfosecurity.com/blackcat-attacks-university-pisa-demands-45m-ransom-a-19338
  • https://www.bankinfosecurity.com/pennsylvania-health-system-ceo-confirms-blackcat-attack-a-21279
  • https://www.bleepingcomputer.com/news/microsoft/microsoft-blackcats-sphynx-ransomware-embeds-impacket-remcom/
  • https://www.bleepingcomputer.com/news/security/alphv-gang-claims-ransomware-attack-on-constellation-software/
  • https://www.bleepingcomputer.com/news/security/alphv-ransomware-adds-data-leak-api-in-new-extortion-strategy/
  • https://www.bleepingcomputer.com/news/security/alphv-ransomware-claims-loandepot-prudential-financial-breaches/
  • https://www.bleepingcomputer.com/news/security/alphv-ransomware-gang-claims-attack-on-florida-circuit-court/
  • https://www.bleepingcomputer.com/news/security/bandai-namco-confirms-hack-after-alphv-ransomware-data-leak-threat/
  • https://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/
  • https://www.bleepingcomputer.com/news/security/blackcat-alphv-ransomware-asks-5-million-to-unlock-austrian-state/
  • https://www.bleepingcomputer.com/news/security/blackcat-ransomware-claims-attack-on-european-gas-pipeline/
  • https://www.bleepingcomputer.com/news/security/blackcat-ransomware-claims-attack-on-italian-energy-agency/
  • https://www.bleepingcomputer.com/news/security/blackcat-ransomware-claims-breach-of-healthcare-giant-henry-schein/
  • https://www.bleepingcomputer.com/news/security/blackcat-ransomware-fails-to-extort-australian-commercial-law-giant/
  • https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azure-storage-with-sphynx-encryptor/
  • https://www.bleepingcomputer.com/news/security/blackcat-ransomware-shuts-down-in-exit-scam-blames-the-feds/
  • https://www.bleepingcomputer.com/news/security/blackcat-ransomware-turns-off-servers-amid-claim-they-stole-22-million-ransom/
  • https://www.bleepingcomputer.com/news/security/colombian-energy-supplier-epm-hit-by-blackcat-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/fashion-giant-moncler-confirms-data-breach-after-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/global-it-services-provider-inetum-hit-by-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/hessen-consumer-center-says-systems-encrypted-by-ransomware/
  • https://www.bleepingcomputer.com/news/security/htc-global-services-confirms-cyberattack-after-data-leaked-online/
  • https://www.bleepingcomputer.com/news/security/japanese-watchmaker-seiko-breached-by-blackcat-ransomware-gang/
  • https://www.bleepingcomputer.com/news/security/mclaren-health-care-says-data-breach-impacted-22-million-people/
  • https://www.bleepingcomputer.com/news/security/motel-one-discloses-data-breach-following-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/norton-healthcare-discloses-data-breach-after-may-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/ransomware-gang-cloned-victim-s-website-to-leak-stolen-data/
  • https://www.bleepingcomputer.com/news/security/ransomware-gang-creates-site-for-employees-to-search-for-their-stolen-data/
  • https://www.bleepingcomputer.com/news/security/reddit-hackers-threaten-to-leak-data-stolen-in-february-breach/
  • https://www.bleepingcomputer.com/news/security/trans-northern-pipelines-investigating-alphv-ransomware-attack-claims/
  • https://www.bleepingcomputer.com/news/security/unitedhealth-subsidiary-optum-hack-linked-to-blackcat-ransomware/
  • https://www.databreaches.net/almost-everything-you-have-posted-in-your-news-article-about-this-incident-is-a-total-crap-blackcat-to-bangladeshi-news-outlets/
  • https://www.databreaches.net/alphv-claims-an-attack-before-even-alerting-the-victim-how-will-that-work-out-for-them/
  • https://www.databreaches.net/alphv-files-an-sec-complaint-against-meridianlink-for-not-disclosing-a-breach-to-the-sec/
  • https://www.databreaches.net/alphv-reacts-to-law-enforcement-action-by-allowing-affiliates-to-attack-hospitals-critical-infrastructure/
  • https://www.databreaches.net/another-small-firm-suffers-a-serious-ransomware-attack-cadre-services-gets-mauled-by-alphv/
  • https://www.databreaches.net/blackcat-attempts-to-up-the-pressure-on-suffolk-county-starts-to-leak-data/
  • https://www.databreaches.net/exclusive-advarra-hacked-threat-actors-threatening-to-leak-data/
  • https://www.databreaches.net/henry-schein-re-encrypted-by-blackcat-again/
  • https://www.databreaches.net/if-at-first-you-dont-succeed-screw-it-up-again/
  • https://www.databreaches.net/the-big-bad-blackcat-tries-to-bully-hampton-newport-news-csb-shame-on-blackcat/
  • https://www.mandiant.com/resources/blog/alphv-ransomware-backup
  • https://www.theregister.com/2023/06/22/blackcat_ransomware_plastic_surgery_clinic/
  • https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/
  • in the past few days.
  • leaks data
  • litigation after ransomware attack
  • officials say
  • screw it up again?
  • starts to leak data?
  • threat actors threatening to leak data
  • three universities - FIU
  • who demanded a $5 million to unlock the encrypted computer systems.
  • “BlackCat” attempts to up the pressure on Suffolk County

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No separately curated network indicators or file hashes are listed for this actor. Known exploited vulnerabilities appear in the CISA Known Exploited Vulnerabilities (KEV) section below.

Malware and Tools

  • BlackEnergy:
  • BLACKCOFFEE:
  • Blackshades:
  • BlackNix:
  • Windows Remote Desktop:
  • BlackHole:
  • BlackCat:
  • GO Simple Tunnel:
  • Impacket:
  • LaZagne:
  • MEGAsync:
  • Mimikatz:
  • Munchkin:
  • PsExec:
  • Remcom:
  • WebBrowserPassView:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.

CISA Known Exploited Vulnerabilities (KEV)

The following CVEs are known to be exploited by this actor, listed in the CISA KEV catalog.

CVE ID Vendor Product Date Added
CVE-2021-27876 Veritas Backup Exec Agent 2023-04-07
CVE-2021-27877 Veritas Backup Exec Agent 2023-04-07
CVE-2021-27878 Veritas Backup Exec Agent 2023-04-07
CVE-2022-24521 Microsoft Windows 2022-04-13
CVE-2016-0099 Microsoft Windows 2022-03-03