BlackMatter (Windows)
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:02:33
Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications government-and-public-sector
Context
According to PCrisk, BlackMatter is a piece of malicious software categorized as ransomware. It operates by encrypting data for the purpose of making ransom demands for the decryption tools. In other words, files affected by BlackMatter are rendered inaccessible, and victims are asked to pay - to recover access to their data. During the encryption process, files are appended with an extension consisting of a random character string. For example, a file initially named "1.jpg" would appear as something similar to "1.jpg.k5RO9fVOl". After this process is complete, the ransomware changes the desktop wallpaper and created a ransom note - "[random_string].README.txt" (e.g., k5RO9fVOl.README.txt).
Reports & references
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- Trend Micro — Lockbit Ransomware Group Augments Its Latest Variant Lockbit 3 (report)
- blog.group-ib.com — Blackmatter (report)
- blog.group-ib.com — Blackmatter2 (report)
- Cisco Talos — From Blackmatter To Blackcat Analyzing (report)
- blogs.blackberry.com — Threat Thursday Blackmatter Ransomware As A Service (report)
- medium.com — Blackmatter X Babuk Using The Same Web Server For Sharing Leaked Files D01C20A74751 (report)
- medium.com — Groove X Ramp The Relation Between Groove Babuk Ramp And Blackmatter F75644F8F92D (report)
- medium.com — Grooves Thoughts On Blackmatter Babuk And Interruption In The Supply Of Cheese In The B5328Bc764F2 (report)
- news.sophos.com — Blackmatter Ransomware Emerges From The Shadow Of Darkside (report)
- thehackernews.com — Researchers Connect Blackcat Ransomware (report)
- therecord.media — Darkside Ransomware Gang Moves Some Of Its Bitcoin After Revil Got Hit By Law Enforcement (report)
- twitter.com — 1451465959894667275 (report)
- CISA — Aa21 291A (report)
- bleepingcomputer.com — Darkside Ransomware Rushes To Cash Out 7 Million In Bitcoin (report)
- CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 2 (report)
- elliptic.co — Darkside Bitcoins On The Move Following Government Cyberattack Against Revil Ransomware Group (report)
- hhs.gov — Demystifying Blackmatter (report)
- Mandiant — Chasing Avaddon Ransomware (report)
- McAfee — How Groove Gang Is Shaking Up The Ransomware As A Service Market To Empower Affiliates (report)
- youtube.com — Watch (report)
- assets.virustotal.com — 2021Trends (report)
- blog.digital-investigations.info — 2021 08 05 Understanding Blackmatters Api Hashing (report)
- blog.minerva-labs.com — Blackmatter (report)
- cert.ssi.gouv.fr — 20220427 Np Tlpwhite Anssi Fin7 (report)