LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1068: BlackCat

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.[1][2][3]

EnterpriseS1068MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

BlackCat is a ransomware family written in Rust and offered through a ransomware-as-a-service model. For leaders, the important point is not the language it is written in, but the breadth of behaviors ATT&CK associates with it: discovery of users, systems, shares, storage, and domain groups; movement of tools; privilege-related activity; impairment of defenses and recovery; and data encryption or destructive impact. This makes BlackCat relevant to business continuity planning, backup resilience, privileged access governance, Windows/Linux endpoint visibility, and incident response readiness.

Executive priority

Treat this as a ransomware readiness benchmark rather than a single malware signature problem. Executives should ask whether the organization can detect and contain pre-encryption discovery and lateral tool transfer, whether recovery paths can withstand attempts to inhibit system recovery, and whether Windows and Linux coverage is consistent. The relationship to Scattered Spider in ATT&CK adds threat-intelligence relevance, but local exposure and prioritization should be based on the organization’s identity controls, backup design, critical service dependencies, and SOC telemetry maturity.

Technical view

ATT&CK does not provide an official detection section for BlackCat, so validation should be behavior-led using the mapped techniques. SOC and IR teams should test visibility for Windows command shell and WMI execution, registry modification, token/UAC-related privilege activity, Windows event log clearing, domain account/group enumeration, remote system and network share discovery, local storage and file discovery, lateral file transfer, service stopping, recovery inhibition, encryption-for-impact, internal defacement, and disk content wipe behaviors. Coverage should be verified across the supplied platforms for the malware object, Linux and Windows, while recognizing that some related techniques list additional platforms in ATT&CK.

Likely telemetry

  • Endpoint process creation and command-line telemetry on Windows and Linux
  • Windows event logs, including Security, System, Application, and log-clearing events
  • WMI activity and remote management execution evidence
  • Registry modification telemetry
  • Identity and directory queries for domain users, groups, and permissions

Detection direction

  • Prioritize detections for behavior chains rather than a malware name alone: discovery followed by lateral transfer, privilege activity, defense impairment, recovery inhibition, and encryption or wipe activity.
  • Tune discovery detections to distinguish administrative inventory activity from unusual enumeration by unexpected users, hosts, timing, or scope.
  • Validate alerting for WMI and command shell execution used from unusual parent processes, accounts, or remote sources.
  • Confirm that attempts to clear Windows Event Logs are collected centrally so endpoint log deletion does not remove the only evidence.
  • Correlate domain account, group, remote system, and share discovery with later service stopping or file modification spikes.

Mitigation priorities

  • Sequence controls around ransomware resilience: least privilege, hardened administrative access, segmentation, tested backups, and recovery controls that are monitored for tampering.
  • Restrict and monitor administrative execution paths such as WMI, command shell usage, registry modification, service control, and file permission changes.
  • Reduce lateral movement opportunity by limiting unnecessary shares, controlling internal file transfer paths, and monitoring privileged access to shared storage.
  • Protect backup and recovery mechanisms from routine domain compromise, and test restoration under an incident scenario where recovery features may have been disabled or deleted.
  • Ensure endpoint, identity, and logging controls cover both Windows and Linux assets that support critical business services.
Additional notes and limits

The supplied ATT&CK object identifies BlackCat as Rust-based ransomware offered via RaaS, first observed in November 2021, and used against multiple sectors and regions. ATT&CK also records that Scattered Spider uses this object and maps BlackCat to multiple discovery, execution, privilege, defense-impairment, lateral-movement, and impact techniques. This take intentionally focuses on defensive decision value and does not infer current activity, specific victim exposure, or guaranteed detection.

MITRE does not provide an official detection section for this object, and the object-level tactics are not specified. Technique relationships give useful behavioral context, but local validation is required to determine which behaviors are relevant, visible, and actionable in a given environment. Platform coverage should be interpreted conservatively from the supplied object platforms and related technique platforms.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

BlackCat

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1570Lateral Tool Transfer

BlackCat can replicate itself across connected servers via `psexec`.[1]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

BlackCat can clear Windows event logs using `wevtutil.exe`.[1]

EnterpriseT1018Remote System Discovery

BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.[1]

EnterpriseT1486Data Encrypted for Impact

BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances.[1]

EnterpriseT1489Service Stop

BlackCat has the ability to stop VM services on compromised networks.[1][2]

EnterpriseT1082System Information Discovery

BlackCat can obtain the computer name and UUID.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

BlackCat can bypass UAC to escalate privileges.[1]

EnterpriseT1087.002Domain AccountSub-technique

BlackCat can utilize `net use` commands to identify domain users.[1]

EnterpriseT1112Modify Registry

BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`[1]

EnterpriseT1069.002Domain GroupsSub-technique

BlackCat can determine if a user on a compromised host has domain admin privileges.[1]

EnterpriseT1047Windows Management Instrumentation

BlackCat can use `wmic.exe` to delete shadow copies on compromised networks.[1]

EnterpriseT1680Local Storage Discovery

BlackCat can enumerate local drives.[1]

EnterpriseT1135Network Share Discovery

BlackCat has the ability to discover network shares on compromised networks.[1][2]

EnterpriseT1222.001Windows PermissionsSub-technique

BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks.[1]

EnterpriseT1491.001Internal DefacementSub-technique

BlackCat can change the desktop wallpaper on compromised hosts.[1][2]

EnterpriseT1561.001Disk Content WipeSub-technique

BlackCat has the ability to wipe VM snapshots on compromised networks.[1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

BlackCat can execute commands on a compromised network with the use of `cmd.exe`.[1]

EnterpriseT1083File and Directory Discovery

BlackCat can enumerate files for encryption.[1]

EnterpriseT1033System Owner/User Discovery

BlackCat can utilize `net use` commands to discover the user name on a compromised host.[1]

EnterpriseT1490Inhibit System Recovery

BlackCat can delete shadow copies using `vssadmin.exe delete shadows /all /quiet` and `wmic.exe Shadowcopy Delete`; it can also modify the boot loader using `bcdedit /set {default} recoveryenabled No`.[1]

EnterpriseT1134Access Token Manipulation

BlackCat has the ability modify access tokens.[1][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1015: Scattered Spider

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1570: Lateral Tool TransferEnterpriseuses · TechniqueT1685.005: Clear Windows Event LogsEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1069.002: Domain GroupsEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1222.001: Windows PermissionsEnterpriseuses · TechniqueT1491.001: Internal DefacementEnterpriseuses · TechniqueT1561.001: Disk Content WipeEnterpriseuses · GroupG1015: Scattered SpiderEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1134: Access Token ManipulationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
fd84985015c22ca1...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundlefd84985015c2…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  2. [2]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  3. [3]
    ACSC BlackCat Apr 2022

    Australian Cyber Security Centre. (2022, April 14). 2022-004: ACSC Ransomware Profile - ALPHV (aka BlackCat). Retrieved December 20, 2022.

    Open source URL
  4. [4]
    CISA Scattered Spider Advisory November 2023

    CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.

    Open source URL
  5. [5]
    MSTIC Octo Tempest Operations October 2023

    Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.

    Open source URL
  6. [6]
    Mandiant UNC3944 May 2025

    Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.

    Open source URL
  7. [7]
    Check Point Scattered Spider JUL 2025

    Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.

    Open source URL
  8. [8]
    ACSC BlackCat Apr 2022

    Australian Cyber Security Centre. (2022, April 14). 2022-004: ACSC Ransomware Profile - ALPHV (aka BlackCat). Retrieved December 20, 2022.

    Open source URL
  9. [9]
    ACSC BlackCat Apr 2022

    Australian Cyber Security Centre. (2022, April 14). 2022-004: ACSC Ransomware Profile - ALPHV (aka BlackCat). Retrieved December 20, 2022.

    Open source URL
  10. [10]
    ALPHV

    (Citation: Microsoft BlackCat Jun 2022)(Citation: ACSC BlackCat Apr 2022)

  11. [11]
    ALPHV

    (Citation: Microsoft BlackCat Jun 2022)(Citation: ACSC BlackCat Apr 2022)

  12. [12]
    ALPHV

    (Citation: Microsoft BlackCat Jun 2022)(Citation: ACSC BlackCat Apr 2022)

  13. [13]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  14. [14]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  15. [15]
    Noberus

    (Citation: ACSC BlackCat Apr 2022)

  16. [16]
    Noberus

    (Citation: ACSC BlackCat Apr 2022)

  17. [17]
    Noberus

    (Citation: ACSC BlackCat Apr 2022)

  18. [18]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  19. [19]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  20. [20]
    mitre-attackS1068
    Open source URL
  21. [21]
    mitre-attackS1068
    Open source URL
  22. [22]
    mitre-attackS1068
    Open source URL
  23. [23]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  24. [24]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  25. [25]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  26. [26]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  27. [27]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  28. [28]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  29. [29]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  30. [30]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  31. [31]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  32. [32]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  33. [33]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  34. [34]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  35. [35]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  36. [36]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  37. [37]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  38. [38]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  39. [39]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  40. [40]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  41. [41]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  42. [42]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  43. [43]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  44. [44]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  45. [45]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  46. [46]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  47. [47]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  48. [48]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  49. [49]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  50. [50]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  51. [51]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  52. [52]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  53. [53]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  54. [54]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  55. [55]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  56. [56]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  57. [57]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  58. [58]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  59. [59]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  60. [60]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  61. [61]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  62. [62]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
  63. [63]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  64. [64]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  65. [65]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  66. [66]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  67. [67]
    Microsoft BlackCat Jun 2022

    Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.

    Open source URL
  68. [68]
    Sophos BlackCat Jul 2022

    Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use