BlackCat

Current data indicates primary delivery of BlackCat is via 3rd party framework/toolset (e.g., Cobalt Strike) or via exposed (and vulnerable) applications.

The affiliate then gained access to the victim's network to steal data and deploy the ransomware to encrypt data and leave a ransom note.

The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'

BlackCat also spawns a number of its own processes, with syntax (for Windows) as follows: WMIC.exe ... cmd.exe ... reg.exe ... vssadmin.exe ... arp -a

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Current data indicates primary delivery of BlackCat is via 3rd party framework/toolset (e.g., Cobalt Strike) or via exposed (and vulnerable) applications.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

The affiliate then gained access to the victim's network to steal data and deploy the ransomware to encrypt data and leave a ransom note.

MITRE ATT&CK T1543.003 – Create or Modify System Process: Windows Service

Current data indicates primary delivery of BlackCat is via 3rd party framework/toolset (e.g., Cobalt Strike) or via exposed (and vulnerable) applications.

MITRE ATT&CK T1543.003 – Create or Modify System Process: Windows Service

MITRE ATT&CK T1027 – Obfuscated Files or Information

MITRE ATT&CK T1027.002 – Obfuscated Files or Information: Software Packing

The ALPHV threat group is an early adopter of extortion schemes such as threatening victims with DDoS attacks, leaking exfiltrated data online...

Current data indicates primary delivery of BlackCat is via 3rd party framework/toolset (e.g., Cobalt Strike) or via exposed (and vulnerable) applications.

MITRE ATT&CK T1140 – Encode/Decode Files or Information

MITRE ATT&CK T1202 – Indirect Command Execution

The LockBit 3.0 ransomware uses a variety of anti-analysis techniques to hinder static and dynamic analysis... Several techniques are implemented for detecting the presence of a debugger and hindering dynamic analysis.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

MITRE ATT&CK T1007 – System Service Discovery

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

Immediately upon launch, the malware will attempt to validate the existence of the previously mentioned access-token, followed by querying for the system UUID (wmic).

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.

The LockBit 3.0 ransomware uses a variety of anti-analysis techniques to hinder static and dynamic analysis... Several techniques are implemented for detecting the presence of a debugger and hindering dynamic analysis.

MITRE ATT&CK T1550.002 – Use Alternate Authentication Material: Pass the Hash

Most recently, IcedID has reportedly been used to download and execute Quantum Locker ransomware... Emotet is being used to load Quantum and ALPHV ransomware... and is being used to load and execute IcedID.

The current version of Qyick does not have data exfiltration capabilities. However, lucrostm has announced that future versions will feature execution of arbitrary executable code, meant primarily for the execution of data exfiltration capabilities.

The affiliate then gained access to the victim's network to steal data and deploy the ransomware to encrypt data and leave a ransom note.

The victim was directed to the ALPHV BlackCat panel hosted on the dark web where the victim could communicate with the ransomware group to negotiate the ransom.

-- no -vm-snapshot-kill Do not wipe VMs snapshots on ESXi

By June 2023, Octo Tempest started deploying ALPHV/BlackCat ransomware payloads... This activity targets both Windows and Unix/Linux endpoints and VMware hypervisors using a variant of ALPHV/BlackCat.

BlackCat attempts to delete VSS (Volume Shadow Copies)... cmd.exe (vssadmin.exe) /c "vssadmin.exe delete shadows /all /quiet" ... wmic.exe Shadowcopy Delete ... bcdedit.exe /set {default} recoveryenabled No

The ALPHV threat group is an early adopter of extortion schemes such as threatening victims with DDoS attacks...

In one instance, the three men extorted a victim for roughly $1.2 million in Bitcoin and then split the proceeds. | Starting in April of that year, while working as a negotiator on behalf of five ransomware victims, Martino shared confidential information with BlackCat attackers about his clients’ positions and strategies to help maximize their ransom payments. That information included details such as victims’ insurance policy limits and other internal negotiation positions.

A Muddled Libra-style social-engineering campaign against a major host-city hotel operator collapses room access, mobile check-in and PoS for 48-72 hours