HackerFeeds
All ransomware groups

blackmatter

32 tracked victims
·first seen 2021-09-08·last activity 2021-11-04

Activity analysis

HackerFeeds has tracked 32 victims claimed by blackmatter since September 2021, most recently in November 2021 — ranking #141 of 332 groups (0.1% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in November 2021. Its most-targeted sector is Agriculture and Food Production (6 victims), followed by Technology (4). The United States accounts for 2 victims (100% of those with a known location); 30 victims did not disclose a location.

Victims per year

  • 202132

Top sectors

  • Agriculture and Food Production6
  • Technology4
  • Consumer Services4
  • Construction4
  • Business Services4
  • Manufacturing3

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Ransomware-as-a-Service

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1078Valid Accounts

    BlackMatter purchased access to already-compromised networks from initial access brokers on underground forums, targeting organizations with 500-15,000 hosts and revenues of $100M+.

TA0002

Execution

  • T1047Windows Management Instrumentation

    WMI used for remote execution across compromised systems.

  • T1053.005Scheduled Task/Job: Scheduled Task

    Scheduled tasks used to execute the ransomware payload at a specific time across target systems.

TA0005

Defense Evasion

  • T1027Obfuscated Files or Information

    BlackMatter payloads are packed with custom packers; configuration stored in encrypted form within the binary.

  • T1562.001Disable or Modify Tools

    Security tools terminated using the Windows Restart Manager API before encryption begins.

TA0006

Credential Access

  • T1003OS Credential Dumping

    Credential dumping tools used to harvest domain and local account credentials for lateral movement.

TA0007

Discovery

  • T1082System Information Discovery

    System locale and language checked; execution halted on CIS-region machines.

  • T1135Network Share Discovery

    Network shares, mapped drives, and connected resources enumerated to maximize encryption scope.

TA0008

Lateral Movement

  • T1021.001Remote Services: Remote Desktop Protocol

    RDP used for lateral movement with harvested credentials.

  • T1021.002Remote Services: SMB/Windows Admin Shares

    SMB used to propagate the ransomware payload to remote hosts across the network.

TA0010

Exfiltration

  • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

    Data exfiltrated to actor-controlled infrastructure and cloud storage for double extortion via the BlackMatter leak site.

TA0011

Command and Control

  • T1071.001Application Layer Protocol: Web Protocols

    HTTPS used for C2 communication; Tor onion addresses used for victim portals.

TA0040

Impact

  • T1486Data Encrypted for Impact

    BlackMatter uses Salsa20 for file content encryption and RSA-1024 for key protection. Partial file encryption (first 1MB) used for speed on large files. Targets Windows, Linux (ESXi), and NAS devices. Active July-November 2021 before announcing shutdown; considered successor to DarkSide.

  • T1490Inhibit System Recovery

    Volume shadow copies removed; Windows recovery options disabled to prevent victim recovery without payment.

Recent victims

No victims tracked yet.