BLACKMATTER
BlackMatter is a ransomware-as-a-service (RaaS) operation that emerged in late July 2021 after the apparent shutdown of DarkSide and REvil. Multiple sources link it to the former DarkSide ecosystem: Microsoft states ELBRUS/FIN7 released BlackMatter in July 2021 as DarkSide’s successor and retired it in November 2021, while Sophos assessed BlackMatter shows multiple technical connections to DarkSide but is not simply identical code or a direct rebrand. BlackMatter has also been discussed in reporting about later ransomware lineages, including overlaps with LockBit 3.0/LockBit Black and ALPHV/BlackCat, and ExMatter is identified as BlackMatter’s custom data-exfiltration tool.
BlackMatter is a double-extortion ransomware family. Reported campaigns involved both file encryption and exfiltration of victim data, with ransom demands backed by threats to delete or publicly expose stolen information. Splunk content states BlackMatter campaigns targeted healthcare and other vertical sectors, citing an HHS bulletin. BlackMatter has also been listed among ransomware families observed targeting VMware ESXi environments.
Technically, BlackMatter uses in-place, multithreaded, partial file encryption and renames files before encryption. Sophos reported that it appends a decryption blob to the end of encrypted files, sets a ransom wallpaper very similar to DarkSide’s, uses runtime API resolution and runtime string decryption, and changes file DACLs to grant Everyone full access before encryption. The analyzed sample collected victim host details and sent them to a remote server hosted on paymenthacks.com. BlackMatter supports Safe Mode encryption via the -safe switch and can enable the built-in local Administrator account, configure AutoAdminLogon, set RunOnce registry entries, and use bcdedit to reboot into Safe Mode with Networking before encrypting files; afterward it removes the safeboot setting and restarts the machine. It also uses the elevated COM object Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} for UAC bypass. Splunk detections and attack simulations further associate BlackMatter with AutoAdminLogon registry modification, DefaultUserName/DefaultPassword registry additions under Winlogon, bcdedit-based Safe Mode boot changes, return-to-normal boot changes, wallpaper modification, stopping security and backup services, and schcache access caused by creation of an ADSI object for an LDAP query.
Observed deployment tradecraft includes execution via a scheduled task that runs a PowerShell script from a domain-accessible UNC path, with the ransomware binary base64-encoded inside the script. Cisco Talos compared a September 2021 BlackMatter intrusion with a later BlackCat intrusion and found BlackMatter operators using GOST for reverse SSH tunneling, scheduled tasks for persistence, LSASS dumping via comsvcs.dll minidump through rundll32, lateral movement via Impacket wmiexec, WinRM/PowerShell, RDP, and PsExec/RemCom, firewall changes to permit inbound TCP 5985, Group Policy-based domain-wide deployment using apply.ps1 and gpupdate /force, and execution of ransomware binaries from the domain controller’s NETLOGON share. Talos also noted a BlackMatter attack may have involved exploitation of Microsoft Exchange vulnerabilities, though with low confidence.
BlackMatter is associated in the provided content with ELBRUS/FIN7 and the post-DarkSide ransomware ecosystem. Reporting also notes likely connections between RAMP forum members and BlackMatter, and later reporting on ALPHV/BlackCat describes overlaps with the now-defunct BlackMatter family. High-confidence indicators directly mentioned in the content include the Sophos-analyzed sample SHA-256 22D7D67C3AF10B1A37F277EBABE2D1EB4FD25AFBD6437D4377400E148BCC08D6, the paymenthacks.com server used by that sample for host-information transmission, and Talos infrastructure including the domain windows[.]menu and IPs 52.149.228[.]45 and 20.46.245[.]56 observed in related intrusion activity.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In 2023, FIN7 expanded its operations to include the deployment of ransomware through affiliations with RaaS groups such as REvil and Maze, while also managing its own RaaS programs, including the now-retired Darkside and BlackMatter.
ELBRUS retired the DarkSide ransomware ecosystem in May 2021 and released its successor, BlackMatter, in July 2021.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
3 techniques
Execution
once a BlackMatter operator gains access to a target’s network and is ready to deploy the ransomware, a scheduled task is set up that executes a PowerShell script on a domain-accessible UNC path on a server
Persistence
4 techniques
Persistence
once a BlackMatter operator gains access to a target’s network and is ready to deploy the ransomware, a scheduled task is set up that executes a PowerShell script on a domain-accessible UNC path on a server
Create the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon registry key and set it to 1... Create an entry under the HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ registry key
Privilege Escalation
5 techniques
Privilege Escalation
once a BlackMatter operator gains access to a target’s network and is ready to deploy the ransomware, a scheduled task is set up that executes a PowerShell script on a domain-accessible UNC path on a server
Change the default boot configuration to safe mode with networking, by running this command: bcdedit /set {current} safeboot network... When the ransomware has finished encrypting, it runs the following command... bcdedit /deletevalue {current} safeboot
Create an entry under the HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ registry key, using a random string starting with an asterisk
Stealth
2 techniques
Stealth
Like DarkSide (and REvil), BlackMatter uses a run-time API that can hinder static analysis of the malware. And like the other two ransomware groups, strings are also encrypted and revealed during runtime... stores configuration information in the binary in an encoded format.
Defense Impairment
1 technique
Defense Impairment
Discovery
4 techniques
Discovery
SophosLabs decoded this and found that BlackMatter ransomware has a similar structure and information stored in the configuration blob, like lists of processes and services to kill
The BlackMatter ransomware collects information from victim machines, like hostname, logged in user, operating system, domain name, system type (architecture), language, as well as the size of the disk and available free space.
Exfiltration
2 techniques
Exfiltration
Impact
3 techniques
Impact
Attackers move directly to deploying ransomware by editing a Group Policy.
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a model ESXi locker/admin panel for future ransomware development by Black Basta.
Ransomware that uses bcdedit to force compromised hosts into Safe Mode with Networking so encryption can continue while bypassing some security controls.
Ransomware associated with behavior that stops backup, security, and recovery-related Windows services prior to file encryption.
Ransomware that manipulates boot configurations to facilitate encryption processes.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.