BlackField (also tracked as BlackFL or Yamag) is an enterprise-focused ransomware strain first recorded in July 2025 that adds .BlackFL to encrypted files and drops a note named BlackField_ReadMe.txt or BlackField-ReadMe.txt. The note is a long numbered letter: it says servers are locked, reachable backups were wiped and corporate data was copied out, then offers a test decryption and a so-called security report in return for payment. Operators negotiate through email, Telegram and Tox, and say they will review the victim's finances and cyber-insurance cover before naming a price. Unpaid victims are threatened with the sale of stolen records to other criminals and publication on a leak blog that lists manufacturers and other mid-size firms worldwide. Code analysis places it in the Conti family tree, and several engines label samples as LockBit or Conti derivatives.
File extensions: .BlackFL
Ransom note filenames: BlackField_ReadMe.txt, BlackField-ReadMe.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161