Blackfield

☆ pin

Also known as BlackField

Reports

First seen

Jun 29, 2026

Last seen

Jul 6, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×2 Other ×2

Victim regions

×1

×2

Taiwan×2

Japan×1

Brazil×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×2T1190 Exploit Public-Facing Application ×2T1105 Ingress Tool Transfer ×1T1041 Exfiltration Over C2 Channel ×1T1555 Credentials from Password Stores ×1T1005 Data from Local System ×1T1059 Command and Scripting Interpreter ×1T1195 Supply Chain Compromise ×1T1567 Exfiltration Over Web Service ×1T1566 Phishing ×1

Indicators

cve ×5domain ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-1212 CVE-2026-46242 (exploited)CVE-2026-46817 (exploited)CVE-2026-8037 (exploited)CVE-2026-8451 (exploited)

Recent reports

High

Blackfield

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Weekly Threat Intelligence Report – July 6: Ransomware Attacks, AI Threats, and Critical Vulnerabilities

Blackfield ransomware gang claims redeplastrs.com.br victim

Japanese insurer, brewer, manufacturer and telecom disclose cyber breaches

Blackfield ransomware demands $2 million from Nidec Corporation

Blackfield publishes new victim: ccic.com.tw