Loading story…
BlackMatter launched as a ransomware-as-a-service operation focused on large enterprises in the US, UK, Canada, and Australia, seeking victims with at least $100 million in annual revenue and roughly 500 to 15,000 hosts. The group recruited initial access brokers on underground forums and offered up to $100,000 for exclusive network access, while advertising support for Windows, Linux, VMware ESXi, and NAS environments. Researchers and incident responders linked BlackMatter to DarkSide through overlapping targeting language, underground tradecraft, and technical similarities in the malware, including use of Salsa20 and RSA-1024; ransom demands reportedly reached $3 million to $4 million.
The operation presented itself as avoiding hospitals, government, defense, and critical infrastructure, but reporting tied it to attacks affecting major organizations and parts of critical U.S. infrastructure. By early November, BlackMatter told affiliates it was shutting down, saying pressure from local authorities had made part of the team unavailable and that its infrastructure would be taken offline within 48 hours, while decryptors would remain available on request. The closure followed mounting scrutiny that connected BlackMatter to DarkSide and FIN7, secret victim assistance from Emsisoft via a decryptor, and broader law-enforcement pressure on ransomware groups after high-profile incidents such as the Colonial Pipeline attack.
TTPs, infrastructure, and targeting history in one profile.
17 events from the most recent confirmed update back to the earliest known activity.
BlackMatter posted a shutdown message in its affiliate portal saying the operation was closing because of pressure from authorities and because part of its team was no longer available.
A GitHub repository published a 'DarkSide & BlackMatter Config Extractor' tool that parses embedded configuration data from ransomware samples into JSON. By version 1.0, the tool added support for BlackMatter 3.0 and exposed fields including ransom notes, AES and RSA keys, sample hashes, and malware version identifiers.
BlackMatter listed SolarBR, a major Coca-Cola bottler in Brazil, on its leak site and claimed to have stolen 50 GB of confidential data spanning finance, logistics, and development. The posting included a ransom deadline of August 23, 2021.
Researchers identified and reverse engineered a BlackMatter Linux ELF64 ransomware sample designed specifically for VMware ESXi servers. The sample used an "esxi_utils" library and the esxcli tool to enumerate ESXi details, disable the firewall, and forcibly shut down virtual machines before encryption.
According to the new reference, BlackMatter’s first observed campaign targeted a U.S.-based architecture company around July 28, 2021. This adds a specific early victim/campaign detail beyond prior general reporting that the group had begun attacking victims by late July.
On July 27, 2021, BlackMatter began distributing recruitment messages over Exploit's Jabber server, seeking experienced penetration testers for Windows and Linux environments as well as initial access suppliers. This marked a distinct expansion from its earlier forum post soliciting access to compromised corporate networks.
S2W Lab published reporting on Haron and identified multiple similarities to Avaddon, while stopping short of conclusively calling it a rebrand.
BlackMatter was introduced on cyber-underground forums and began advertising for initial access brokers to reach large corporate networks.
The first sample of Haron malware was submitted to VirusTotal, providing the earliest dated indicator of that separate ransomware group's emergence discussed alongside BlackMatter.
Flashpoint said BlackMatter registered accounts on the Russian-language underground forums XSS and Exploit, marking its early public emergence in cybercrime spaces.
By the end of July 2021, BlackMatter was actively attacking multiple corporate victims, targeting Windows, Linux, and ESXi systems and demanding roughly $3 million to $4 million.
A sample of BlackMatter ransomware was found in late July 2021, adding technical evidence of the group's active tooling.
As the operation emerged, BlackMatter established a dark web leak site that was still empty and published a claimed exclusion list covering hospitals, critical infrastructure, oil and gas, defense, nonprofits, and government.
BlackMatter launched operations in late July 2021, posting ads on Exploit and XSS for access to large networks in the US, UK, Canada, and Australia and offering up to $100,000 for qualifying access.
Analysis of a BlackMatter decryptor found the same distinctive Salsa20 and RSA-1024 encryption routines previously associated with DarkSide, strengthening claims that BlackMatter was a rebrand or successor.
One BlackMatter victim reportedly paid $4 million and in return received deletion of stolen data and decryptors for Windows and Linux ESXi systems.
Recorded Future analysts observed BlackMatter infrastructure earlier in the week and assessed a possible connection to the former DarkSide operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 66 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
13 references tracked. Mallory keeps watching after this page renders.
id-ransomware.blogspot.com
Open sourcevaronis.com
Open sourcetherecord.media
Open sourcegithub.com
Open sourcethreatpost.com
Open sourceflashpoint-intel.com
Open sourcetherecord.media
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that **BlackCat** (also tracked as **ALPHV**) shares infrastructure, tools, filenames, and intrusion tradecraft with the **BlackMatter/DarkSide** ransomware ecosystem, indicating with moderate confidence that at least one BlackMatter affiliate became an early BlackCat operator rather than the group being a simple rebrand. In side-by-side intrusions, Talos observed similar human-operated attack phases including persistent access through tunneling tools, credential theft via **LSASS** dumping, lateral movement with **Impacket `wmiexec`**, **WinRM/PowerShell**, and **RDP**, and domain-wide ransomware deployment from the domain controller’s **NETLOGON** share after scripts such as `apply.ps1`, `defender.vbs`, and `def.vbs` were staged. Talos said BlackCat dwell time exceeded 15 days in one case and noted that more than 30 percent of observed compromises affected U.S.-based organizations. Other reporting and technical analyses describe BlackCat as a **Rust-based ransomware-as-a-service** platform that emerged in late 2021, recruited affiliates from groups including **REvil, BlackMatter, and DarkSide**, and offered operators roughly **80 to 90 percent** of ransom proceeds. Researchers said the malware targets **Windows, Linux, and VMware ESXi** environments, uses double extortion with Tor-based payment portals, and includes capabilities such as **CMSTPLUA** privilege escalation, shadow-copy deletion, service and process termination, and configurable encryption using embedded keys. The overlap with DarkSide-era techniques is reinforced by prior DarkSide analyses showing similar affiliate-driven operations, extortion infrastructure, and malware behaviors, supporting the view that BlackCat grew out of the same criminal talent pool rather than appearing as an entirely separate threat.
Aug 15, 2026
Blockchain analysis linked **DarkSide** to at least **$90 million** in bitcoin ransom payments over roughly nine months, tracing funds across 47 wallets tied to the ransomware-as-a-service operation. Two of the group’s most prominent victims accounted for about **$10 million** of that total: **Colonial Pipeline**, which paid nearly **$5 million**, and chemical distributor **Brenntag**, which paid **$4.4 million**. The gang’s affiliate model reportedly gave partners **75% to 90%** of each payment, while the core operators retained a smaller share that still amounted to about **$15.5 million** in bitcoin. DarkSide’s campaign also involved data theft as well as encryption. Brenntag said attackers accessed its North America systems in late April 2021, exfiltrating sensitive personal data affecting more than **6,700 individuals**, including Social Security numbers, dates of birth, driver’s license numbers, and some medical information; the company said DarkSide claimed to have stolen **150GB** of data and that access may have been obtained through purchased stolen credentials. After the Colonial Pipeline attack drew intense scrutiny, DarkSide said it lost control of parts of its infrastructure and some ransom funds before abandoning operations, while major cybercrime forums including **XSS**, **Exploit**, and **RAID** banned ransomware advertisements and other gangs shifted toward private affiliate arrangements rather than disappearing entirely.
Aug 15, 2026
Researchers reported that **Exmatter**, a custom ransomware data-exfiltration tool first tied to **BlackMatter**, has evolved into a more capable pre-encryption theft utility and has appeared in intrusions linked to other ransomware operators, including a **LockBit** affiliate. Earlier analyses described Exmatter as an obfuscated `.NET` tool that scans logical drives, filters files by extension, size, and location, and steals high-value business data such as documents, source code, and CAD/GIS files. It primarily exfiltrates data over **SFTP**, with later versions adding **WebDAV** support, reinforcing the role of data theft and double extortion in modern ransomware operations. A newer variant observed by S-RM added features that make Exmatter more autonomous during intrusions, including enumeration of mapped network drives from the Windows registry, lateral movement over network shares, remote self-execution using **TinyIPC**, and the ability to take ownership of restricted files when run with administrator privileges. The sample also embedded a Base64-encoded WebDAV client for command-and-control and used **HTTP PUT** over port `80` for exfiltration; in one case, attackers reportedly stole up to **1 TB** of data before deploying ransomware. The activity aligns with Microsoft’s broader assessment that ransomware affiliates increasingly swap payloads and tooling while relying on hands-on intrusion, credential abuse, persistence, and pre-ransomware data theft as core elements of the extortion model.
Aug 15, 2026