Blacktail
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:10:12
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications manufacturing
Context
Blacktail is a cybercrime group that has gained attention for its ransomware campaigns, particularly the Buhti ransomware. They are known for using custom-built data exfiltration tools and have been observed exploiting vulnerabilities in both Windows and Linux systems.
Reports & references
- Broadcom/Symantec — Buhti Ransomware (report)
- fortiguard.fortinet.com — 5170 (report)
- redpacketsecurity.com — New Buhti Ransomware Gang Uses Leaked Windows Linux Encryptors (report)
- redpacketsecurity.com — Buhti Ransomware Gang Switches Tactics Utilizes Leaked Lockbit And Babuk Code (report)