Loading story…
Researchers reported that Exmatter, a custom ransomware data-exfiltration tool first tied to BlackMatter, has evolved into a more capable pre-encryption theft utility and has appeared in intrusions linked to other ransomware operators, including a LockBit affiliate. Earlier analyses described Exmatter as an obfuscated .NET tool that scans logical drives, filters files by extension, size, and location, and steals high-value business data such as documents, source code, and CAD/GIS files. It primarily exfiltrates data over SFTP, with later versions adding WebDAV support, reinforcing the role of data theft and double extortion in modern ransomware operations.
A newer variant observed by S-RM added features that make Exmatter more autonomous during intrusions, including enumeration of mapped network drives from the Windows registry, lateral movement over network shares, remote self-execution using TinyIPC, and the ability to take ownership of restricted files when run with administrator privileges. The sample also embedded a Base64-encoded WebDAV client for command-and-control and used HTTP PUT over port 80 for exfiltration; in one case, attackers reportedly stole up to 1 TB of data before deploying ransomware. The activity aligns with Microsoft’s broader assessment that ransomware affiliates increasingly swap payloads and tooling while relying on hands-on intrusion, credential abuse, persistence, and pre-ransomware data theft as core elements of the extortion model.
Get the actors, campaigns, and ATT&CK mapping behind it.
16 events from the most recent confirmed update back to the earliest known activity.
S-RM reported that the Exmatter sample observed in its case had a compile time of 2024-01-18 01:37:26 and included new capabilities for mapped-drive discovery, IPC-assisted spread, remote execution, and WebDAV-based exfiltration over HTTP PUT.
S-RM said it had observed the affiliate later tracked as Velvet Tempest deploying LockBit 3.0 payloads since August 2023.
S-RM cited Microsoft attribution that Velvet Tempest, formerly DEV-0504, created and used Exmatter and had deployed Ryuk, REvil, LockBit 2.0, BlackMatter, Conti, and BlackCat/ALPHV between December 2021 and June 2022.
Microsoft reported that it observed no Conti deployment in its data after April 19, 2022, suggesting the program shut down or went on hiatus.
Microsoft observed ELBRUS abusing CVE-2021-31207 in April 2022 to escalate low-privileged Exchange access to SYSTEM-level access.
Microsoft said leaked Conti chat files from February 2022 confirmed the broad scale of DEV-0193 operations.
Microsoft said DEV-0504 deployed BlackCat against energy and other sectors in January 2022 while continuing to rely on access brokers, Cobalt Strike, and PsExec.
Microsoft stated that ELBRUS retired the BlackMatter ransomware operation in November 2021.
Microsoft reported that ELBRUS replaced the DarkSide ransomware-as-a-service ecosystem with BlackMatter in July 2021.
Kroll analyzed multiple Exmatter samples in Q4 2021 and found the tool was originally associated with BlackMatter before later variants appeared with other ransomware groups.
Microsoft said the affiliate tracked as DEV-0504 had deployed at least six ransomware-as-a-service payloads since 2020, reflecting its role as a prolific multi-program affiliate.
Microsoft described ELBRUS, also known as FIN7, as a long-running financially motivated group active since 2012 before later shifting into ransomware and extortion activity.
S-RM disclosed a recent ransomware engagement in which a LockBit affiliate used a new Exmatter variant to move laterally over network shares, remotely execute itself, take ownership of restricted files, and exfiltrate up to 1 TB of data before ransomware deployment.
Microsoft published a ransomware-as-a-service report identifying DEV-0504 as a prolific affiliate that had shifted across multiple payloads and used common intrusion tooling and access-brokered entry.
Symantec's Threat Hunter Team disclosed Exmatter as a custom .NET exfiltration utility used before ransomware deployment and noted multiple variants with evolving file targeting, exclusion logic, and SFTP/WebDAV infrastructure.
Symantec reported that at least one BlackMatter affiliate used the custom Exmatter data exfiltration tool to steal selected files before deploying ransomware on victim networks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
s-rminform.com
Open sourcemicrosoft.com
Open sourcekroll.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026
LockBit expanded its ransomware-as-a-service operations with **StealBit**, a custom exfiltration tool used by affiliates to steal data before encryption and support double-extortion demands. Research shows StealBit was built for high-throughput theft, using named-pipe interprocess communication via `STEALBIT-MASTER-PIPE` and Windows I/O completion ports to parallelize transfers, while sending stolen file contents over HTTP `PUT` requests to attacker-controlled infrastructure embedded in the malware. Analysts also found anti-analysis checks, encrypted strings and endpoint data, and later versions that added self-deletion, transfer throttling, and partial window-hiding, although some advertised features such as hidden execution and compression were incomplete or misleading in examined samples. The tool formed part of the broader **LockBit 2.0** playbook, which resurfaced as a more aggressive operation combining rapid encryption, data theft, and automated spread across Windows domains through Active Directory group policies. Trend Micro reported detections tied to LockBit 2.0 activity in Chile, Italy, Taiwan, and the UK, noting that affiliates also abused legitimate tools such as Process Hacker and PC Hunter and used scripts to disable defenses, stop services, and clear logs. The ransomware partially encrypted files, appended the `.lockbit` extension, dropped `Restore-My-Files.txt` ransom notes, and threatened to leak stolen data, while later research tracked the gang’s exfiltration infrastructure as defenders worked to hunt StealBit-related activity.
Aug 14, 2026
Cisco Talos reported that **BlackCat** (also tracked as **ALPHV**) shares infrastructure, tools, filenames, and intrusion tradecraft with the **BlackMatter/DarkSide** ransomware ecosystem, indicating with moderate confidence that at least one BlackMatter affiliate became an early BlackCat operator rather than the group being a simple rebrand. In side-by-side intrusions, Talos observed similar human-operated attack phases including persistent access through tunneling tools, credential theft via **LSASS** dumping, lateral movement with **Impacket `wmiexec`**, **WinRM/PowerShell**, and **RDP**, and domain-wide ransomware deployment from the domain controller’s **NETLOGON** share after scripts such as `apply.ps1`, `defender.vbs`, and `def.vbs` were staged. Talos said BlackCat dwell time exceeded 15 days in one case and noted that more than 30 percent of observed compromises affected U.S.-based organizations. Other reporting and technical analyses describe BlackCat as a **Rust-based ransomware-as-a-service** platform that emerged in late 2021, recruited affiliates from groups including **REvil, BlackMatter, and DarkSide**, and offered operators roughly **80 to 90 percent** of ransom proceeds. Researchers said the malware targets **Windows, Linux, and VMware ESXi** environments, uses double extortion with Tor-based payment portals, and includes capabilities such as **CMSTPLUA** privilege escalation, shadow-copy deletion, service and process termination, and configurable encryption using embedded keys. The overlap with DarkSide-era techniques is reinforced by prior DarkSide analyses showing similar affiliate-driven operations, extortion infrastructure, and malware behaviors, supporting the view that BlackCat grew out of the same criminal talent pool rather than appearing as an entirely separate threat.
Aug 15, 2026