BlackCat

The Scattered Spider actors affiliated with BlackCat are also known to use the ransomware gang's data leak site as part of their extortion attempts, where they leak data or issue statements.

Scattered Spider is a cyber gang linked to SIM swapping, fake IT calls, and ransomware crews like ALPHV... DiMaggio listened in on this call, which was one of the group's recent attempts to infiltrate American retail organizations.

The affiliate then gained access to the victim's network to steal data and deploy the ransomware to encrypt data and leave a ransom note.

The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'

knowingly caused the transmission of a program, information, code, and command, and, as a result of such conduct, intentionally caused damage without authorization to a protected computer

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Counsel said that a page on the darkweb, a collection of websites that can only be accessed by a specific browser, was located where the ransom demands were outlined.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

The affiliate then gained access to the victim's network to steal data and deploy the ransomware to encrypt data and leave a ransom note.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

After establishing a foothold on the network, Scattered Spider uses a range of publicly available software tools for reconnaissance and lateral movement, including ... Screenconnect ... Splashtop ... Teamviewer ... Tailscale ... Ngrok

According to the Shodan search engine, the two hostnames were associated with thousands of internet-facing devices exposing RDP services (TCP port 3389) in December 2025.

The infrastructure commonly supports ransomware command and control (C2) servers, malware distribution, phishing campaigns, botnet management, and data exfiltration staging.

Most recently, IcedID has reportedly been used to download and execute Quantum Locker ransomware... Emotet is being used to load Quantum and ALPHV ransomware... and is being used to load and execute IcedID.

A new tactic observed in the threat group’s recent attacks is data exfiltration and file encryption using the ALPHV/BlackCat ransomware, followed by communication with the victims ... to negotiate a ransom payment.

The affiliate then gained access to the victim's network to steal data and deploy the ransomware to encrypt data and leave a ransom note.

The victim was directed to the ALPHV BlackCat panel hosted on the dark web where the victim could communicate with the ransomware group to negotiate the ransom.

The 2023 Muddled Libra (operators of ALPHV aka BlackCat ransomware) campaign against entertainment organizations demonstrated that the hospitality stack is a target for ransomware operators

Examples include 'Avaddon uses wmic.exe to delete shadow copies,' 'BlackCat can use wmic.exe to delete shadow copies on compromised networks,' and 'WannaCry utilizes wmic to delete shadow copies.'

BlackCat was one of the first high-profile examples of triple extortion ransomware. Along with encryption and data extortion, it used a third technique: adding DDoS components to the attack.

MARTINO also provided confidential information regarding ransomware negotiations to ALPHV BlackCat co-conspirators while employed at Company 1 as a ransomware negotiator.

In one instance, the three men extorted a victim for roughly $1.2 million in Bitcoin and then split the proceeds. | Starting in April of that year, while working as a negotiator on behalf of five ransomware victims, Martino shared confidential information with BlackCat attackers about his clients’ positions and strategies to help maximize their ransom payments. That information included details such as victims’ insurance policy limits and other internal negotiation positions.

A Muddled Libra-style social-engineering campaign against a major host-city hotel operator collapses room access, mobile check-in and PoS for 48-72 hours