malware family

BlackCat

unknownentity:malware_familyransomware · 1 source

BlackCat (ALPHV) is ransomware written in Rust. The ransomware makes heavy use of plaintext JSON configuration files to specify the ransomware functionality. BlackCat has many advanced capabilities like escalating privileges and bypassing UAC make use of AES and ChaCha20 or Salsa encryption, may use the Restart Manager, can delete volume shadow copies, can enumerate disk volumes and network shares automatically, and may kill specific processes and services. The ransomware exists for both Windows

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: blackcat
kind: malware family
status: unknown
aliases: ALPHV · Noberus
jurisdictions: —
claims naming it: 2 · 0 attributions · 1 relations · 0 events

Identifiers

attack S1068via mitre-attack
misp-galaxy e6c09b63-a424-4d9e-b7f7-b752cbbca02avia misp-galaxy-ransomware

Relations

MITRE ATT&CK Enterpriserecords thatScattered SpiderusesBlackCat
fetch —sha256 dc1639caa5501d72
rel_215btcintel:relations:215@v1 sha256:8e202bad692b6a41
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 2 of 2

BlackCatransomwarepayment
subjecttransaction9467a41c9c…40f3df5d27
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b · 35,021,268,866 sat · time 2024-03-01 22:40 UTC · url https://ransomwhe.re/#address/14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32319btcintel:annotations:32319@v3 sha256:ef99cb54fa41be95
confidencetrusted provider · 50
BlackCatransomwarepayment address
subjectaddress14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw BlackCat · url https://ransomwhe.re/#address/14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32318btcintel:annotations:32318@v2 sha256:abe09debb0cc8d71
confidencetrusted provider · 50

Subjects2 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.