Overview
Platforms:
—
Variants:
—
Extensions:
—
ATT&CK software:
—
Initial access:
—
Top countries:
—
Observed sectors:
—
Tracked victims:
29
Attribution
ELBRUS
VERIFIED
Operator tracking name
Microsoft tracks ELBRUS as the activity group that operated DarkSide and subsequently launched and operated the BlackMatter ransomware-as-a-service ecosystem.
Affiliates
DEV-0504
Documented BlackMatter affiliate
Activity
Recent Observations
BlackMatter shuts down
November 2021
Operational closure
BlackMatter announced the closure of its ransomware-as-a-service operation amid increasing law-enforcement pressure.
U.S. government advisory
October 2021
Critical infrastructure activity
CISA, FBI and NSA reported BlackMatter attacks against multiple U.S. critical infrastructure organizations, including entities in the Food and Agriculture Sector.
NEW Cooperative attack
September 2021
Major incident
BlackMatter ransomware affected NEW Cooperative, an Iowa-based agricultural cooperative, during the U.S. harvest season.
TTPs
ATT&CK coverage:
7 techniques
· 4 tactics
T1018
Remote System Discovery
VERIFIEDDiscovery
BlackMatter used LDAP and SMB to discover hosts within Active Directory environments.
T1057
Process Discovery
VERIFIEDDiscovery
BlackMatter used NtQuerySystemInformation to enumerate running processes.
T1007
System Service Discovery
VERIFIEDDiscovery
BlackMatter used EnumServicesStatusExW to enumerate running services.
Show more TTPs (4)
T1021.002
SMB/Windows Admin Shares
VERIFIEDLateral Movement
BlackMatter used SMB to connect to discovered administrative and network shares.
T1567
Exfiltration Over Web Service
VERIFIEDExfiltration
BlackMatter attempted to exfiltrate victim data for use in extortion.
T1486
Data Encrypted for Impact
VERIFIEDImpact
BlackMatter remotely encrypted discovered systems and network shares.
T1561
Disk Wipe
VERIFIEDImpact
BlackMatter actors were reported to wipe or reformat backup systems and data stores.
Victims
NEW Cooperative
CONFIRMED
Agriculture & Food organization in United States.
CVEs
No CVE associations available.
Infrastructure
BlackMatter leak site
Tor-hosted infrastructure was used to publish stolen victim information as part of BlackMatter's double-extortion model.
BlackMatter affiliate panel
A private ransomware-as-a-service platform was operated for affiliates to obtain ransomware builds, communicate with operators and manage victim negotiations.
Timeline
2021-11
BlackMatter operation closes
The operators announced that the ransomware-as-a-service project was shutting down amid pressure from authorities.
2021-11
Victims transferred to LockBit
Some existing BlackMatter affiliates moved ongoing victim negotiations to LockBit infrastructure after the shutdown.
2021-10
Critical infrastructure warning
CISA, FBI and NSA issued a joint advisory after BlackMatter attacks against multiple U.S. critical infrastructure organizations.
Show more events (2)
2021-09
NEW Cooperative attack
BlackMatter ransomware targeted the U.S. agricultural cooperative NEW Cooperative.
2021-07
BlackMatter emerges
BlackMatter appeared as a new ransomware-as-a-service ecosystem following the retirement of DarkSide.
Sources
BlackMatter Ransomware
CISA / FBI / NSA
Show more sources (3)
BlackMatter ransomware claims to be shutting down due to police pressure
BleepingComputer
Incident report
New Cooperative Ransomware Case Study
Idaho National Laboratory / CyOTE