BlackMatter (Windows)
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:02:33
Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications government-and-public-sector
Context
According to PCrisk, BlackMatter is a piece of malicious software categorized as ransomware. It operates by encrypting data for the purpose of making ransom demands for the decryption tools. In other words, files affected by BlackMatter are rendered inaccessible, and victims are asked to pay - to recover access to their data. During the encryption process, files are appended with an extension consisting of a random character string. For example, a file initially named "1.jpg" would appear as something similar to "1.jpg.k5RO9fVOl". After this process is complete, the ransomware changes the desktop wallpaper and created a ransom note - "[random_string].README.txt" (e.g., k5RO9fVOl.README.txt).
Reports & references
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- forescout.com — New Ransomware Operator Exploits Fortinet Vulnerability Duo (report)
- CrowdStrike — Big Game Hunting On The Rise Again According To Ecrime Index (report)
- CrowdStrike — How Big Game Hunting Ttps Shifted After Darkside Pipeline Attack (report)
- blogs.blackberry.com — Kraken The Code On Prometheus (report)
- news.sophos.com — The Ransomware Threat Intelligence Center (report)
- Broadcom/Symantec — The Ransomware Threat September 2021 (report)
- splunk.com — Gone In 52 Seconds And 42 Minutes A Comparative Analysis Of Ransomware Encryption Speed (report)
- splunk.com — An Empirically Comparative Analysis Of Ransomware Binaries (report)
- Broadcom/Symantec — Sed Fy22Q2 Ses Ransomware Threat Landscape Wp (report)
- bleepingcomputer.com — Blackmatter Ransomware Moves Victims To Lockbit After Shutdown (report)
- glimps.fr — Lockbit3 0 (report)
- Trend Micro — Lockbit Ransomware Group Augments Its Latest Variant Lockbit 3 (report)
- blog.group-ib.com — Blackmatter (report)
- blog.group-ib.com — Blackmatter2 (report)
- Cisco Talos — From Blackmatter To Blackcat Analyzing (report)
- blogs.blackberry.com — Threat Thursday Blackmatter Ransomware As A Service (report)
- medium.com — Blackmatter X Babuk Using The Same Web Server For Sharing Leaked Files D01C20A74751 (report)
- medium.com — Groove X Ramp The Relation Between Groove Babuk Ramp And Blackmatter F75644F8F92D (report)
- medium.com — Grooves Thoughts On Blackmatter Babuk And Interruption In The Supply Of Cheese In The B5328Bc764F2 (report)
- news.sophos.com — Blackmatter Ransomware Emerges From The Shadow Of Darkside (report)
- thehackernews.com — Researchers Connect Blackcat Ransomware (report)
- therecord.media — Darkside Ransomware Gang Moves Some Of Its Bitcoin After Revil Got Hit By Law Enforcement (report)
- twitter.com — 1451465959894667275 (report)
- CISA — Aa21 291A (report)