What tactics and techniques does BlackCat (ALPHV) use?

How BlackCat’s playbook usually starts

BlackCat operations typically begin with access that already looks legitimate: valid accounts, exposed remote services or a compromised remote administration path. That matters because the group does not need a noisy exploit chain to get value from the environment. Once inside, the emphasis is on moving quickly from foothold to control, rather than lingering on a single workstation.

The attack path is often shaped by convenience and reach. A single credentialed login or trusted tool can be enough to pivot into higher-value systems, especially where remote access is broad and segmentation is weak. In practice, the early stage is less about a single signature and more about a sequence of access, enumeration and expansion that blends into normal administration.

What BlackCat does after access is established

After initial access, the group commonly pursues privilege escalation and lateral movement so it can reach more systems with fewer barriers. That is where the campaign becomes operationally dangerous: the intruder is no longer just in the network, but able to act across it, including servers that hold business-critical data or recovery tooling.

The typical pattern also includes data theft before encryption. That sequencing gives attackers leverage beyond simple file denial, because exfiltrated data can be used to pressure the victim even if systems are restored. Coordinated archive creation, staging and outbound transfers are therefore important indicators, especially when they appear alongside unusual remote sessions or admin activity.

BlackCat crews also tend to disrupt recovery before detonation. Disabling backups, deleting snapshots, tampering with restore points or otherwise reducing rollback options makes the encryption stage more effective and can lengthen outage time materially. For defenders, the practical takeaway is that pre-encryption activity often matters more than the encryption event itself.

Operational clues that separate intrusion from routine admin

The most useful clues are usually behavioural rather than purely technical. Look for rapid credential use across multiple systems, remote tooling used outside its normal pattern, unusual archive or compression activity, and administrative actions that affect backups, security tools or recovery paths. Those signals often cluster before the ransom note appears.

Detection improves when analysts treat ransomware as a campaign, not a single event. If one account suddenly touches many hosts, if remote management is used at odd hours, or if large data movements occur before encryption, the environment may already be in the exfiltration and staging phase. That is the point where containment is still possible without waiting for file encryption to prove the attack.

For a broader view of this threat pattern, the Ransomware Groups Guide helps place BlackCat in the wider ransomware-as-a-service ecosystem, while the Change Healthcare breach 2024 and MGM Resorts breach 2023 show how valid access, identity abuse and remote tooling can create the opening BlackCat-style operators need.

Risk and Threat Considerations

BlackCat is dangerous because it combines access abuse, lateral movement and extortion in one campaign. The same access path that gets an attacker into the environment can also be used to steal data, disable recovery and spread encryption, which turns a single compromise into an enterprise-wide outage.

Failure mechanism: The attack succeeds when legitimate accounts, remote access services or trusted admin channels are not tightly bounded, allowing the operator to move from one foothold to broad control before defenders detect the sequence.

Impact: Organisations can face simultaneous data theft, service disruption, recovery delays and coercion, with the worst outcomes appearing when backup controls and privileged access are both compromised.

Practitioner Guidance

What to verify: Confirm which accounts, remote tools and backup systems can reach production systems without step-up checks. If those paths are broad, assume the attacker’s lateral movement window is larger than your perimeter view suggests.

Decision rule: If you see credential abuse plus outbound archive activity, prioritise isolation of affected identities, remote access paths and backup administration first. Waiting for full encryption confirmation usually gives the operator more time to spread and exfiltrate.

What good looks like: Remote administration is tightly scoped, privileged access is observable, backups are protected from the same credentials used for day-to-day operations, and suspicious movement can be linked quickly to a named account, host and session.

Practitioner takeaway: Against BlackCat, the critical question is not whether encryption can happen, but whether an attacker can reach, move, exfiltrate and blind recovery before your controls force them to stop.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What is the difference between prompt techniques and tactics in adversarial prompt engineering?
• How should security teams adapt phishing defenses when attackers use reverse proxy techniques to intercept login sessions?
• What is the difference between tactics and techniques in the MITRE ATT&CK framework?