Description Summary
BlackLock is a rebranded version of another ransomware group known as Eldorado. It has since become one of the most active extortion syndicates in 2025, heavily targeting technology, manufacturing, construction, finance, and retail sectors.
Threat Actor
Rebrand of El Dorado; RaaS; infrastructure breached by Resecurity in early 2025.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
ChaCha20 + RSA-OAEP (Golang, cross-platform)
Ransom Note Name
Not publicly reported
Targeted Industries
Construction, Real estate (broad)
First Seen
~September 2024 (rebrand of El Dorado)
Last Seen
Declining (post early-2025 infra breach)
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |