Loading story…
The BlackMagic ransomware group targeted transportation and logistics organizations in Israel, publicly naming more than ten victims and claiming to have stolen roughly 50GB of data. Researchers said the operation combined encryption with double extortion, but unlike typical ransomware campaigns, the group reportedly omitted payment instructions from its ransom note and instead advertised stolen data on social media and cybercrime forums. The leaked material was described as sensitive transportation-sector information that could affect more than 65% of Israeli citizens, and investigators said the campaign showed signs of both disruptive and financially motivated activity.
Technical analysis found BlackMagic used malware aligned with MITRE ATT&CK T1486 (Data Encrypted for Impact). The payload was a 64-bit DLL launched through rundll32.exe, used repeated sleep calls to evade sandboxing, terminated numerous processes, disabled Task Manager, contacted 5.230.70.49, encrypted files with the Rijndael algorithm, and appended the .BlackMagic extension. It also dropped a batch file to change the desktop wallpaper, force a reboot, and remove traces, while researchers noted similarities to earlier anti-Israel disruptive ransomware activity, including Moses Staff.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
During a threat-hunting exercise, Cyble Research and Intelligence Labs identified a ransomware group named BlackMagic and published technical analysis of its malware, infrastructure, and tactics. The report assessed that the activity may be politically motivated, possibly linked to Iran, while also showing signs of financial motivation through attempted data sales.
Cyble reported that the BlackMagic ransomware group targeted organizations in Israel's transportation and logistics sector, using double extortion and disruptive actions such as database destruction, altered lading bills, and website defacements. The group publicly disclosed more than ten Israeli victims and claimed to have stolen about 50GB of data affecting over 65% of Israeli citizens.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Basta emerged as a fast-growing ransomware-as-a-service operation that hit organizations across the United States, Canada, the United Kingdom, Australia, and New Zealand, with victims reported in manufacturing, construction, transportation, telecommunications, and pharmaceuticals. The group has been tied to human-operated intrusions that begin with spearphishing emails and password-protected ZIP archives, often delivering **QakBot** through ISO or JavaScript-based loaders that can bypass Windows Mark-of-the-Web protections, including abuse linked to `CVE-2022-44698`. After initial access, the attackers use **SystemBC**, **Cobalt Strike**, and **Mimikatz** for command and control, credential theft, persistence, and lateral movement, including SMB service execution and **PsExec**. Black Basta operators commonly try to disable Windows Defender and EDR tools, exfiltrate data with **Rclone**, delete volume shadow copies, encrypt files with the `.basta` extension, and leave a `readme.txt` ransom note while threatening to publish stolen data on a TOR leak site if payment is not made.
Aug 15, 2026
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026
Leaked internal records exposed how the **Black Basta** ransomware operation relied on the bulletproof hosting provider **Media Land** (also known as **Yalishanda**) for servers, domains, proxy services, bandwidth, and technical support. A leak of roughly 190,000–200,000 Black Basta Matrix chat messages, followed by a leak of Media Land’s internal database, revealed operational links between the two organizations and identified **Aleksandr Volosovik** as the operator behind Yalishanda and **Kirill Zatolokin** (aka **Slim Shady**) as a support and infrastructure operator who bridged Media Land and Black Basta. The disclosures showed Black Basta functioning as a structured ransomware enterprise that used cryptocurrency to pay for infrastructure and maintained abuse-resistant services through a registered front company. The leaked chats and subsequent research also detailed Black Basta’s attack methods across critical infrastructure victims, including phishing, Microsoft Teams and fake IT-support social engineering, exploitation of known vulnerabilities, and use of malware such as **Qakbot**, **Pikabot**, **DarkGate**, **LummaC2**, and **Cobalt Strike**. Researchers found the group abused **EV code-signing certificates**, reused credentials, created corporate-looking domains, and discussed zero-day and CVE exploitation while running double-extortion campaigns. U.S. and allied authorities later sanctioned Media Land, its subsidiary **Data Center Kirishi**, Volosovik, and Zatolokin for supporting cybercrime, underscoring how infrastructure providers enabled Black Basta’s global ransomware operations.
Aug 15, 2026