{
  "family": "blackv",
  "sample_count": 15,
  "category": "ransomware",
  "description": "BlackV (classified across threat intelligence feeds as Ransom:Win32/BlackV and Trojan-Ransom.Win32.BlackV) is an aggressive Windows crypto-ransomware family designed for rapid enterprise file destruction and financial extortion. Once executed, BlackV enumerates fixed disks, mounted network volumes, and USB peripherals, targeting documents, archives, virtual machine images, and databases. BlackV employs a hybrid encryption routine using ChaCha20/AES with an embedded RSA public master key. Encrypted files are renamed with the .blackv extension, and ransom notes titled RESTORE_BLACKV_FILES.txt are created across all processed folders. The ransomware deletes all system shadow copies and event logs.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/BlackV",
    "Trojan-Ransom.Win32.BlackV",
    "Win32/BlackV",
    "BlackV Ransomware",
    "Ransom.BlackV"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/BlackV?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "BlackV is an enterprise crypto-ransomware family that encrypts corporate files across local and network storage."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms does BlackV utilize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses a hybrid scheme combining symmetric stream ciphers (AES/ChaCha20) with RSA public key encapsulation."
      }
    },
    {
      "@type": "Question",
      "name": "How does BlackV hinder forensic investigation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes wevtutil commands to clear Windows event logs and deletes Volume Shadow Copies via vssadmin."
      }
    },
    {
      "@type": "Question",
      "name": "Does BlackV spread to network file shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it aggressively enumerates active SMB network shares and encrypts accessible shared folders."
      }
    },
    {
      "@type": "Question",
      "name": "How should IT teams respond to a BlackV incident?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect affected systems from the corporate LAN, preserve encrypted samples and notes, and restore from immutable backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1070.001",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Blackv from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Blackv persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Blackv attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Blackv modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Blackv dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/BlackV",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/BlackV"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}