BlackCat
Software · ATTACK:enterprise:S1068
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1068",
"title": "BlackCat",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1068",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--50c44c34-3abb-48ae-9433-a2337de5b0bc",
"external_id": "S1068",
"domain": "enterprise",
"created": "2023-02-28T20:50:36.164Z",
"modified": "2025-10-21T15:28:37.027Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Noberus"
},
{
"source_name": "ALPHV"
},
{
"source_name": "ACSC BlackCat Apr 2022",
"url": "https://www.cyber.gov.au/about-us/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat"
},
{
"source_name": "Sophos BlackCat Jul 2022",
"url": "https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/"
},
{
"source_name": "Microsoft BlackCat Jun 2022",
"url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bca4956-d4c5-4149-a493-c0596701dd9a
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ed4dd7a-2e60-4c3e-b70b-5c30f2c28ad6
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25b8605b-9ab2-418f-b92b-abb2be815b90
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29cec373-a87c-444b-b192-9ab94f69a008
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ee6e8e6-914a-4639-88cc-39c01de5d541
Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ca38ed9-3691-461d-81a1-1ad8de5817bb
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4558c2f3-247f-478c-8139-80e7a45208e7
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e0775fd-17b6-44cd-9598-98f1a185b32b
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--552afd93-370d-4f8e-b2c0-e27d9d7e050e
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7114f449-1436-41ca-ab9e-5704bf3552ef
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--737af098-bd8c-4449-b93d-adaaaa55abea
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--800060e1-5bd0-475a-93d0-e0abc36e10d7
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cd85648-3618-4817-a178-d36d7c40631c
Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3fc552f-e16d-4db7-8bca-d1c273b401f9
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bec3259a-58d3-44a5-95c7-c8eb16427e85
Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9af5e2e-3ac5-451a-bc63-c3e26ca6371e
Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd689e6a-443d-4465-b637-a7befde5e052
Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e58bc387-6540-4976-8c12-73ddf15084ed
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6fe7167-0788-4062-9f59-d8ee8398db15
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8c2b8e1-7439-48df-a8c3-6796fd4bb142
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc3e0e8c-d6d3-4f2d-8374-86b7902079a9
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1134
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe3bcb4a-bb14-4068-a9d3-be2f68137f51
Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022