Loading malware…
BlackMatter was a ransomware-as-a-service operation that emerged in July 2021 and is widely assessed as an evolution or rebrand of DarkSide, with notable code, operational, and ecosystem links to both DarkSide and REvil. It targeted large organizations, particularly in English-speaking countries, and was associated with big-game hunting intrusions against enterprises and critical-sector victims despite public claims that certain sectors would be excluded. The operation recruited access brokers and affiliates with access to high-revenue corporate networks and used tailored payloads for victim environments.
BlackMatter primarily targeted Windows environments, while also fielding Linux tooling. Windows payloads were compact, multithreaded ransomware executables that used anti-analysis and evasion techniques such as API hashing, encrypted strings, hidden or obfuscated configuration storage, and privilege escalation via ICMLuaUtil-based UAC bypass. The malware enumerated processes and services, terminated selected applications, deleted shadow copies, and encrypted local and network-accessible data. Reported cryptographic implementations vary across versions and analyses, but the family is consistently described as using hybrid encryption with symmetric file encryption protected by asymmetric keys. BlackMatter also generated ransom notes, changed desktop wallpaper, and communicated victim telemetry and status information to attacker-controlled infrastructure.
BlackMatter affiliates and operators were reported to gain access mainly through exploitation of vulnerable internet-facing infrastructure, abuse of compromised credentials, and purchases from initial access providers, rather than relying primarily on phishing. Once inside a network, the operation used Active Directory, LDAP, SMB, and share enumeration to identify reachable systems and remotely encrypt accessible resources. Advisories also reported credential abuse, administrative-share access, and attempts at data exfiltration for extortion. In some incidents, backup repositories were wiped or reformatted instead of encrypted.
BlackMatter also developed Linux payloads associated with VMware ESXi targeting. Multiple reports describe a Linux encryptor built to shut down virtual machines and encrypt ESXi-hosted data, while other reporting observed Linux payloads used as RAT-like tooling to pivot toward Windows systems. This indicates the operation maintained more than one Linux capability depending on campaign needs. BlackMatter’s ESXi-focused tooling reflected the broader ransomware trend of targeting virtualization infrastructure to maximize operational impact.
The family is notable for implementation overlap with later ransomware ecosystems. Researchers identified strong continuity from DarkSide into BlackMatter, and later observed substantial similarities between BlackMatter and BlackCat/ALPHV configurations and tooling. The ExMatter data-exfiltration utility was used by BlackMatter and later by other major ransomware groups. Code and technique reuse linked BlackMatter as well to later LockBit variants. BlackMatter ceased operations in late 2021, and some victim handling and ecosystem activity reportedly shifted to other ransomware groups.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
À Darkside succède le RaaS BlackMatter, qui disparaît à son tour en novembre 2021.
BlackMatter Ransomware ... Этот крипто-вымогатель шифрует данные бизнес-пользователей с помощью Salsa20 + RSA-1024, а затем требует выкуп в BTC или XMR (Monero) ... BlackMatter был представлен на форумах кибер-андеграунда 21 июля 2021.
At least one affiliate of the BlackMatter ransomware operation has begun using a custom data exfiltration tool in its attacks.
ELBRUS retired the DarkSide ransomware ecosystem in May 2021 and released its successor, BlackMatter, in July 2021.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
The advertiser was looking to recruit parties who could provide access to corporate networks of companies with more than $100,000,000 yearly revenue. This is a common practice for ransomware-as-a-service operations... In this particular case, the BlackMatter user was looking to recruit initial access providers and brokers.
Attempts to log in using credentials from its configuration list to determine if the compromised system is a part of the domain admin that it will use for later routines
the built-in local administrator account being enabled and set for automatic sign in
Performs a 32-bit or 64-bit shellcode injection to elevate its token... LockBit 3.0 is capable of injecting a DLL into memory via reflective loading
Attempts to log in using credentials from its configuration list to determine if the compromised system is a part of the domain admin that it will use for later routines
the built-in local administrator account being enabled and set for automatic sign in
This specific sample is a PowerShell script containing two layers of obfuscated code... The strings it uses are decrypted using a simple bitwise-XOR routine, a bitwise-XOR and NOT routine, or a decryption routine involving a linear congruential generator (LCG) algorithm
BlackMatter also has an encrypted configuration inside the binary, located in a fake PE resource section.
This communication was observed as impersonating the following user-agent strings that may be anomalous in some environments
Performs a 32-bit or 64-bit shellcode injection to elevate its token... LockBit 3.0 is capable of injecting a DLL into memory via reflective loading
Prior to file encryption, BlackMatter wipes the recycle bin folder of every drive on the system... Once found, the folders and their contents are recursively deleted using DeleteFileW.
Attempts to log in using credentials from its configuration list to determine if the compromised system is a part of the domain admin that it will use for later routines
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
LockBit 3.0 also checks the victim machine’s UI language to avoid infecting machines with these languages...
Technique System Service Discovery [T1007] Procedure BlackMatter uses EnumServicesStatusExW to enumerate running services on the network.
the malware calls NtQuerySystemInformation to query information about processes on the system. For each process entry, it checks if the process’s name is explorer.exe...
The victim sends a beacon including the machine name, OS version and CPU architecture, OS language, username, domain name, disk sizes
Encrypts network shares and Exchange Mailbox if set in its configuration flag
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
Knowing DarkSide’s past mistakes, we were surprised when BlackMatter introduced a change to their ransomware payload that allowed us to once again recover victims’ data without the need for a ransom to be paid. | Emsisoft researchers discovered a critical flaw in the BlackMatter ransomware that allowed them to help victims recover their files without paying a ransom.
we have confirmed the values of the following BlackCat’s configuration fields completely match BlackMatter’s. kill_services kill_processes
LockBit 3.0’s deletion of shadow copies is clearly lifted from BlackMatter’s code, as this is performed using Windows Management Instrumentation (WMI) through COM objects, as opposed to LockBit 2.0’s use of vssadmin.exe.
BlackMatter changes the background image, a common practice among ransomware creators.
92 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
102 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BlackMatter is mentioned only as background in the lineage/rebranding of another ransomware operation.
Ransomware-as-a-Service family targeting business users and large enterprises. It encrypts files using Salsa20 + RSA-1024, appends a random extension, drops README ransom notes, can change desktop wallpaper, supports Windows Safe Mode execution, and the operators claim data theft and double extortion.
Mentioned only as another malware family known to use a similar user account control bypass.
Referenced as a model ESXi locker/admin panel for future ransomware development by Black Basta.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.