Blackmatter ransomware group

BlackMatter emerged in July 2021 and quickly positioned itself as the successor to DarkSide (responsible for the Colonial Pipeline attack). It operated as a Ransomware-as-a-Service (RaaS), adopting a double-extortion model—encrypting systems while exfiltrating sensitive data for publication on its leak site. BlackMatter targeted Windows and Linux/VMware ESXi systems, using ChaCha20 for file encryption with RSA-1024 public key protection. The malware appended a custom extension per victim and dropped ransom notes (README.txt) with Tor portal links. The group focused on large organizations in industries such as critical infrastructure, agriculture, technology, and manufacturing, but claimed to avoid hospitals, nonprofits, and government entities (though some reports contradict this). Initial access methods included exploitation of known vulnerabilities, stolen credentials from brokers, and phishing campaigns. BlackMatter ceased operations in November 2021 after reported pressure from law enforcement and possible member arrests.