File · Blacktail · Unknown · misp-galaxy · refreshed 2026-10-06

Blacktail

sigil · no ATT&CK coverage stated

What changed

ledger · newest first

2026-10-18todaynew CVE2 new CVEs: CVE-2022-47986, CVE-2023-27350

Analyst brief

misp-galaxy

Blacktail is a cybercrime group that has gained attention for its ransomware campaigns, particularly the Buhti ransomware. They are known for using custom-built data exfiltration tools and have been observed exploiting vulnerabilities in both Windows and Linux systems.

CVEs Blacktail is cited as exploiting

none on KEV

CVE-2022-479862026-10-17
1. “Blacktail appears quick to utilise new exploits. In February, they were reported to be exploiting a vulnerability in IBM’s Aspera Faspex file-exchange application ( CVE-2022-47986 ).”
  cited as exploiting · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17
2. “Another report indicates that the Blacktail group also exploited the IBM Aspera Faspex code execution vulnerability (CVE-2022-47986).”
  cited as exploiting · source: fortiguard.fortinet.com ↗ · 2026-10-17
CVE-2023-273502026-10-17
1. “Blacktail reportedly exploited the PaperCut MF/NG Improper Access Control vulnerability (CVE-2023-27350) to distribute the Windows version of Buhti ransomware”
  cited as exploiting · source: fortiguard.fortinet.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

4 sources

Track Blacktail on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.