BlackMatter ransomware

BlackMatter was an affiliate ransomware program that ran from July to November 2021. Each victim gets its own random nine-character extension, so a file becomes something like photo.jpg.k5RO9fVOl. The ransom note is a text file whose name is that same string followed by .README.txt, and the desktop wallpaper is replaced with a message pointing to it. The note claims a set amount of data was copied out and lists what kind. Payment talks run through a Tor site. Affiliates went after large firms, mostly in the US, and bought network access from brokers. Builds exist for Windows and for Linux, including ESXi and several NAS systems; the Windows payload deletes shadow copies and also encrypts network shares and unmounted partitions. Stolen data was posted to a leak site when victims did not pay. Its encryption code matches DarkSide, and it is widely treated as that group back under a new name. A flaw in early builds let some victims recover files quietly in mid-2021, until the operators patched it.

File extensions: 3xhKpKRK6, 5rzjWf26s, 84fdeb44, cHpfiXA9s, CHR4bQVWh, g0sOhfQ0Z, tnwdIrTIi

Decryptor: Decryptor availability has not been recorded.