Threat Actor Characterization
Bl00dy
ID: 1fde33249e249e08831798e406e40b5e82752
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Bl00dy is a ransomware operator label/brand associated in public reporting with exploit-driven intrusions (notably PaperCut and ScreenConnect vulnerability windows) and reuse of leaked LockBit 3.0 builder tooling. Victimology is opportunistic and linked to exposure and patch cadence; education sector is explicitly referenced in PaperCut advisory context.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1136.001 | Local Account | TA0003 |
|
| T1059 | Command and Scripting Interpreter | TA0002 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1021.001 | Remote Desktop Protocol | TA0008 |
|
| T1490 | Inhibit System Recovery | TA0040 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
Bl00dy — Ransomware “brand” leveraging leaked LockBit tooling
Classification: TLP:WHITE - Open Source Intelligence (OSINT)
Category: Cybercrime / Ransomware (operator group / “brand”) - Origin: Unknown
Author: iQBlack CTI Team[]
Executive Summary
Bl00dy (also stylized “Bl00Dy” / “BL00DY” in public reporting) is an extortion-and-encryption ransomware operator name that gained visibility through campaigns tied to exploitation of public-facing software vulnerabilities and opportunistic use of tooling from the wider ransomware ecosystem. Public reporting links the group to use of a leaked LockBit 3.0 (“LockBit Black”) builder, which is consistent with a model where smaller actors adopt “commodity” ransomware components rather than maintaining a fully proprietary locker pipeline.
Multiple open sources describe Bl00dy activity clustered around exploit windows for widely deployed enterprise software. Public reporting ties Bl00dy to exploitation of PaperCut print-management vulnerabilities in 2023, and to exploitation of ConnectWise ScreenConnect vulnerabilities disclosed and mass-exploited in February 2024. These patterns suggest an operations model that prioritizes speed-to-exploit, external access acquisition, and rapid disruption (encryption) — consistent with financially motivated ransomware operations.
Confidence is medium on the overall characterization (ransomware brand, exploit-driven access, LockBit-builder reuse) because these claims appear across multiple reputable sources; however, confidence is low-to-medium on whether Bl00dy should be treated as a “LockBit affiliate” in a strict organizational sense. The better-supported view is that Bl00dy leveraged leaked LockBit tooling, which is not equivalent to membership in the LockBit RaaS program.