Description
BlackMatter is a ransomware operation that emerged in July 2021 as a successor to DarkSide, the group behind the Colonial Pipeline attack. Its operators advertised for affiliates on underground forums, and the malware reused much of DarkSide's code base while adding support for Linux and VMware ESXi systems. The operation shut down in November 2021 following mounting pressure and sanctions threats against ransomware infrastructure.
Stats
- First seen
- January 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Binary.Ransomware.BlackMatter |
| ByteCode-MSIL.Ransomware.BlackMatter |
| DeepScan:Generic.Ransom.BlackMatter.A.B5B0DE4A |
| DeepScan:Generic.Ransom.BlackMatter.A.D3D5CBF2 |
| DeepScan:Generic.Ransom.BlackMatter.A.FFFFFFFE |
| Dump:Generic.Ransom.BlackMatter.A.B5B0DE4A |
| Dump:Generic.Ransom.BlackMatter.A.D3D5CBF2 |
| Gen:Variant.Ransom.BlackMatter.1 |
| Gen:Variant.Ransom.BlackMatter.101 |
| Gen:Variant.Ransom.BlackMatter.11 |
