Eldorado ransomware

Eldorado (also written El Dorado) is a ransomware-as-a-service operation that appeared in March 2024 with a Go-based locker built for Windows and for Linux and VMware ESXi. Encrypted files gain the fixed extension .00000001, and the note HOW_RETURN_YOUR_DATA.TXT appears on the desktop and in each user's Documents folder. The note is addressed to the board of directors, claims the network was entered through multiple vulnerabilities and that staff and partner data was downloaded, offers to unlock a couple of small files as proof and directs the victim to a Tor live-chat panel, threatening publication after seven days. Affiliates recruited on a Russian-language forum get builds that can be told which folders and network subnets to hit, and the Windows version spreads to SMB shares and deletes shadow copies. Victims have been mainly mid-sized firms in the United States across professional services, technology and manufacturing, with leaked data posted to the group's site. In late 2024 the same operator rebranded the project as BlackLock, which researchers link to Eldorado through shared code and note wording; BlackLock is a separate generation with its own identifiers.

File extensions: .00000001

Ransom note filenames: HOW_RETURN_YOUR_DATA.TXT

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Likely — The note claims staff and partner data was downloaded and the group publishes victims on a leak site; no advisory-level evidence of the theft itself was found.

Systems typically targeted: Windows systems and network shares, Linux and VMware ESXi hosts

Do this first: Disconnect SMB shares and ESXi management interfaces from the network and preserve a sample file ending in .00000001 together with HOW_RETURN_YOUR_DATA.TXT.