BlackCat

First major ransomware written in Rust for cross-platform capability (Windows, Linux, VMware ESXi). Supports multiple encryption modes and customizable per-victim configurations.

Custom .NET data exfiltration tool that selectively steals documents, databases, and sensitive files before encryption. Uploads to attacker-controlled SFTP servers.

Custom info-stealer that targets Veeam backup credentials stored in SQL databases. Extracts backup admin credentials to enable deletion of backups before ransomware deployment.

Updated BlackCat encryptor variant with built-in tools for network propagation using Impacket's psexec and remcom for lateral movement during encryption.

Standard post-exploitation framework for lateral movement, persistence, and C2. Affiliates deploy custom Cobalt Strike loaders to evade signature-based detections.

Advanced C2 framework used by BlackCat affiliates as Cobalt Strike alternative. Harder for EDR solutions to detect due to syscall-level operation.

Deployed for LSASS memory dumping, DCSync attacks, and Kerberos ticket extraction. Used to achieve domain-wide administrative access before ransomware staging.

Primary remote access tool installed for persistent hands-on-keyboard access. Multiple affiliates deploy AnyDesk on dozens of systems for redundant access.

Remote management tool used by affiliates for persistent access. Harder to detect than C2 beacons since it generates legitimate-looking remote access traffic.

Tunneling tool used to create reverse tunnels to compromised systems, enabling access even when direct inbound connections are blocked by firewalls.

Network discovery tool used to map internal infrastructure, identify domain controllers, file servers, and backup systems for maximum impact targeting.

AD attack path mapping tool used to identify privilege escalation routes from initial access to domain admin for rapid domain compromise.

Credential recovery tool used to extract saved passwords from browsers, email clients, databases, and various Windows credential stores.

Cloud storage service abused for data exfiltration. Affiliates sync stolen data via MEGAsync client, taking advantage of the service's end-to-end encryption.

Used for disabling security tools, deleting shadow copies (vssadmin, wmic shadowcopy), modifying boot configuration, and deploying ransomware via scripts.

Used for remote ransomware deployment across domain-joined systems. Often combined with compromised domain admin credentials from DCSync attacks.

Some BlackCat affiliates (Scattered Spider/UNC3944) specialize in social engineering helpdesk staff for MFA bypass and SIM swapping to gain initial access.