Loading threat actor…
El Dorado, also referred to as Eldorado and later rebranded as BlackLock, is a ransomware-as-a-service operation that emerged publicly in March 2024 on the Russian-language RAMP forum, where it recruited penetration testers and other collaborators. The group has shown notable brand persistence, continuing operations after a September 2024 rename to BlackLock. BlackLock Blog and Mamona Blog have been described as variants operated by the same threat actor. El Dorado is part of the Russian-language cybercriminal ransomware ecosystem and has been active in underground recruitment, advertising ransomware variants, and sharing operational intelligence. It has been assessed among the higher-risk ransomware groups active in the first half of 2025. The group has been associated with targeting industrial and critical infrastructure sectors and has been noted alongside other operators that developed Linux encryptors for VMware ESXi environments, indicating capability against virtualized enterprise infrastructure. Its activity profile is consistent with ransomware operations that obtain initial access, conduct post-compromise actions, steal data, and deploy encryption for extortion. The available information supports classifying El Dorado as a financially motivated cybercriminal actor operating a RaaS model.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Eldorado is a ransomware group present on RAMP, engaging in recruitment and the sharing of ransomware tactics and intelligence.
Parent ransomware lineage referenced through derivative brands involved in inter-group rivalry and extortion-site targeting.
Ransomware operation noted for Linux lockers tailored to VMware ESXi, encrypting VM files and disrupting operations with minimal dwell time.
RaaS group with rebranding history to BlackLock, recruiting penetration testers and targeting key sectors such as healthcare and education; ranked among the top five highest-risk groups in H1 2025.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.