BlackMatter (ELF)
- First seen
- 2021-07-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:02:40
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical retail-and-hospitality
Targeted regions: country_code:us country_code:gb country_code:ca
Context
BlackMatter is a ransomware malware family that emerged in 2021, targeting various sectors including financial services, government, and healthcare. Known for encrypting victim files and demanding a ransom payment, it has primarily affected targets in the US, UK, and Canada.
Reports & references
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
- CrowdStrike — Big Game Hunting On The Rise Again According To Ecrime Index (report)
- CrowdStrike — How Big Game Hunting Ttps Shifted After Darkside Pipeline Attack (report)
- vmware.com — Vmw Exposing Malware In Linux Based Multi Cloud Environments (report)
- Broadcom/Symantec — The Ransomware Threat September 2021 (report)
- umbrella.cisco.com — Cybersecurity Threat Spotlight Blackmatter Lockbit Thor (report)
- bleepingcomputer.com — Blackmatter Ransomware Moves Victims To Lockbit After Shutdown (report)
- blog.group-ib.com — Blackmatter (report)
- blog.group-ib.com — Blackmatter2 (report)
- Cisco Talos — From Blackmatter To Blackcat Analyzing (report)
- blogs.blackberry.com — Threat Thursday Blackmatter Ransomware As A Service (report)
- medium.com — Blackmatter X Babuk Using The Same Web Server For Sharing Leaked Files D01C20A74751 (report)
- medium.com — Groove X Ramp The Relation Between Groove Babuk Ramp And Blackmatter F75644F8F92D (report)
- medium.com — Grooves Thoughts On Blackmatter Babuk And Interruption In The Supply Of Cheese In The B5328Bc764F2 (report)
- news.sophos.com — Blackmatter Ransomware Emerges From The Shadow Of Darkside (report)
- thehackernews.com — Researchers Connect Blackcat Ransomware (report)
- therecord.media — Darkside Ransomware Gang Moves Some Of Its Bitcoin After Revil Got Hit By Law Enforcement (report)
- twitter.com — 1451465959894667275 (report)
- twitter.com — 1423188690126266370 (report)
- CISA — Aa21 291A (report)
- bleepingcomputer.com — Darkside Ransomware Rushes To Cash Out 7 Million In Bitcoin (report)
- bleepingcomputer.com — Linux Version Of Blackmatter Ransomware Targets Vmware Esxi Servers (report)
- CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 2 (report)
- elliptic.co — Darkside Bitcoins On The Move Following Government Cyberattack Against Revil Ransomware Group (report)