ExMatter
ExMatter is a custom data-exfiltration malware/tool used in ransomware double-extortion operations to steal sensitive data prior to file encryption. It is directly associated with the BlackCat/ALPHV (also tracked as Noberus) ransomware operation and was previously associated with BlackMatter; reporting also notes overlaps between BlackCat and BlackMatter. The tool has reportedly been in use since BlackCat’s launch in November 2021, and BlackCat was observed deploying it in August 2022.
High-confidence reported capabilities include selective harvesting/exfiltration of files with specific extensions, generation of a report listing processed files, corruption of processed files via an "Eraser" feature, a self-destruct option to quit and delete itself in non-valid environments, and support for multiple exfiltration methods including SFTP, WebDav, and later FTP. One report states the August 2022 update limited exfiltration to specific file types including PDF, DOC, DOCX, XLS, PNG, JPG, JPEG, TXT, BMP, RDP, SQL, MSG, PST, ZIP, RTF, IPT, and DWG; removed Socks5 support; added an option for GPO deployment; and underwent substantial code refactoring intended to implement features more stealthily and evade detection. Reporting also describes a revamped version that harvests only files with specific extensions, generates a report of processed files, and corrupts files.
In context, ExMatter is used to support BlackCat/ALPHV’s double-extortion model across enterprise intrusions, where data theft is used to pressure victims in addition to ransomware encryption. Mentioned reporting ties its use to ransomware affiliate activity and to BlackCat attacks broadly. One mention context also lists ExMatter among "wiper malware examples," but the dominant and consistently supported characterization in the content is as a custom data-exfiltration tool rather than a standalone wiper. No standalone IOCs for ExMatter are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...deploying custom data exfiltration tools like ExMatter to siphon sensitive data prior to encryption."
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Exfiltration
2 techniques"deploying custom data exfiltration tools like ExMatter ... to siphon sensitive data prior to encryption."
Tool description: “ExMatter… upload… via SFTP” and mapping “T1048… .002: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol”
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom data exfiltration tool originally associated with BlackMatter; observed used by an affiliate whose victims later appeared on LockBit’s leak site, suggesting tool sharing or multi-brand affiliate activity.
Data theft/exfiltration tool used to steal sensitive data prior to ransomware encryption as part of BlackCat’s extortion workflow.
Custom data exfiltration utility used in BlackCat double-extortion operations to steal sensitive data before ransomware encryption.
Data exfiltration utility used in BlackCat operations; updated to selectively harvest files by extension, generate reports of processed files, and corrupt files.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.