Blackmatter Ransomware

Description Summary

Ransomware-as-a-Service

Threat Actor

DarkSide successor RaaS; bought access from initial-access brokers targeting 500–15,000-host enterprises.

Technical Indicators

Encryption Extension
.<random>
Encryption Algorithm
Salsa20 (files) + RSA-1024 (key wrapping); partial encryption
Ransom Note Name
[random].README.txt
Targeted Industries
Agriculture, Manufacturing, Critical infrastructure
First Seen
July 2021
Last Seen
November 2021 (shut down; operators → ALPHV/BlackCat)
Geographical Location
United States, Europe

MITRE ATT&CK Matrix

Tactic TTP Technique Name
Impact x 2 T1486 Data Encrypted for Impact
T1490 Inhibit System Recovery
Exfiltration x 1 T1567 Exfiltration Over Web Service (leak site)
Initial Access x 2 T1190 Exploit Public-Facing Application
T1078 Valid Accounts