BlackLock

BlackLock is a ransomware group established around March 2024, operating under a RaaS model and actively recruiting affiliates. The ransomware is developed in Go, enabling cross-platform attacks on Windows, Linux, and VMware ESXi environments, and employs ChaCha20 for file encryption. BlackLock appends encryption keys and metadata to files for decryption post-ransom payment and utilizes a covert method to delete Volume Shadow Copy Service data to hinder recovery efforts. The group has been linked to operational failures due to significant OPSEC mistakes, including a breach of its leak site that exposed internal data.

Son fəaliyyəti 2 iyl 2025 tarixində qeydə alınıb.

Digər adları: El Dorado, BlackLocks, Eldorado, Mamona, GLOBAL GROUP

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://asec.ahnlab.com/en/90175/
• https://reliaquest.com/blog/threat-spotlight-inside-the-worlds-fastest-rising-ransomware-operator-blacklock/
• https://www.resecurity.com/blog/article/blacklock-ransomware-a-late-holiday-gift-with-intrusion-into-the-threat-actors-infrastructure

Mənbə: MISP Galaxy, Malpedia.