Ransomware group

BLACKMATTER

BlackMatter is a ransomware-as-a-service (RaaS) operation that emerged in late July 2021 after the apparent shutdown of DarkSide and REvil.

Profile source: Mallory

BLACKMATTER

Family profile

BlackMatter is a ransomware-as-a-service (RaaS) operation that emerged in late July 2021 after the apparent shutdown of DarkSide and REvil. Multiple sources link it to the former DarkSide ecosystem: Microsoft states ELBRUS/FIN7 released BlackMatter in July 2021 as DarkSide’s successor and retired it in November 2021, while Sophos assessed BlackMatter shows multiple technical connections to DarkSide but is not simply identical code or a direct rebrand. BlackMatter has also been discussed in reporting about later ransomware lineages, including overlaps with LockBit 3.0/LockBit Black and ALPHV/BlackCat, and ExMatter is identified as BlackMatter’s custom data-exfiltration tool.

BlackMatter is a double-extortion ransomware family. Reported campaigns involved both file encryption and exfiltration of victim data, with ransom demands backed by threats to delete or publicly expose stolen information. Splunk content states BlackMatter campaigns targeted healthcare and other vertical sectors, citing an HHS bulletin. BlackMatter has also been listed among ransomware families observed targeting VMware ESXi environments.

Technically, BlackMatter uses in-place, multithreaded, partial file encryption and renames files before encryption. Sophos reported that it appends a decryption blob to the end of encrypted files, sets a ransom wallpaper very similar to DarkSide’s, uses runtime API resolution and runtime string decryption, and changes file DACLs to grant Everyone full access before encryption. The analyzed sample collected victim host details and sent them to a remote server hosted on paymenthacks.com. BlackMatter supports Safe Mode encryption via the -safe switch and can enable the built-in local Administrator account, configure AutoAdminLogon, set RunOnce registry entries, and use bcdedit to reboot into Safe Mode with Networking before encrypting files; afterward it removes the safeboot setting and restarts the machine. It also uses the elevated COM object Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} for UAC bypass. Splunk detections and attack simulations further associate BlackMatter with AutoAdminLogon registry modification, DefaultUserName/DefaultPassword registry additions under Winlogon, bcdedit-based Safe Mode boot changes, return-to-normal boot changes, wallpaper modification, stopping security and backup services, and schcache access caused by creation of an ADSI object for an LDAP query.

Observed deployment tradecraft includes execution via a scheduled task that runs a PowerShell script from a domain-accessible UNC path, with the ransomware binary base64-encoded inside the script. Cisco Talos compared a September 2021 BlackMatter intrusion with a later BlackCat intrusion and found BlackMatter operators using GOST for reverse SSH tunneling, scheduled tasks for persistence, LSASS dumping via comsvcs.dll minidump through rundll32, lateral movement via Impacket wmiexec, WinRM/PowerShell, RDP, and PsExec/RemCom, firewall changes to permit inbound TCP 5985, Group Policy-based domain-wide deployment using apply.ps1 and gpupdate /force, and execution of ransomware binaries from the domain controller’s NETLOGON share. Talos also noted a BlackMatter attack may have involved exploitation of Microsoft Exchange vulnerabilities, though with low confidence.

BlackMatter is associated in the provided content with ELBRUS/FIN7 and the post-DarkSide ransomware ecosystem. Reporting also notes likely connections between RAMP forum members and BlackMatter, and later reporting on ALPHV/BlackCat describes overlaps with the now-defunct BlackMatter family. High-confidence indicators directly mentioned in the content include the Sophos-analyzed sample SHA-256 22D7D67C3AF10B1A37F277EBABE2D1EB4FD25AFBD6437D4377400E148BCC08D6, the paymenthacks.com server used by that sample for host-information transmission, and Talos infrastructure including the domain windows[.]menu and IPs 52.149.228[.]45 and 20.46.245[.]56 observed in related intrusion activity.

Ransomware.live

Operational record

Exfiltration

PrivatLab

Reported operators

Threat actors

2 named in public reporting

FIN7

In 2023, FIN7 expanded its operations to include the deployment of ransomware through affiliations with RaaS groups such as REvil and Maze, while also managing its own RaaS programs, including the now-retired Darkside and BlackMatter.

Velvet Tempest

ELBRUS retired the DarkSide ransomware ecosystem in May 2021 and released its successor, BlackMatter, in July 2021.

MITRE ATT&CK

BLACKMATTER in ATT&CK

29 distinct techniques

Techniques

29 techniques

T1622 Debugger Evasion T1548.002 Bypass User Account Control T1486 Data Encrypted for Impact T1562.009 Safe Mode Boot T1057 Process Discovery T1112 Modify Registry T1059.001 PowerShell T1562.001 Disable or Modify Tools T1543 Create or Modify System Process T1490 Inhibit System Recovery T1059 Command and Scripting Interpreter T1053 Scheduled Task/Job T1548 Abuse Elevation Control Mechanism T1041 Exfiltration Over C2 Channel T1082 System Information Discovery T1027 Obfuscated Files or Information T1547.001 Registry Run Keys / Startup Folder T1567 Exfiltration Over Web Service T1087.002 Domain Account T1491 Defacement T1078 Valid Accounts T1047 Windows Management Instrumentation T1053.005 Scheduled Task/Job: Scheduled Task T1003 OS Credential Dumping T1135 Network Share Discovery T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage T1071.001 Application Layer Protocol: Web Protocols

Reporting

Research mentioning BLACKMATTER

May 19

Trellix

Analysis of Black Basta Ransomware Chat Leaks

GG recommended looking into Darkside/Blackmatter/BlackCat ESXi locker(s), praising its quality and admin panel.

Feb 25

Splunk Research

Detection: Change To Safe Mode With Network Config | Splunk Security Content

This activity is significant because it is a known technique used by BlackMatter ransomware to force a compromised host into safe mode for continued encryption.

Feb 25

Splunk Research

Detection: Windows Security And Backup Services Stop | Splunk Security Content

Associated Analytic Story BlackMatter Ransomware

Feb 25

Splunk Research

Detection: Bcdedit Command Back To Normal Mode Boot | Splunk Security Content

This activity is significant as it may indicate the presence of ransomware, such as BlackMatter, which manipulates boot configurations to facilitate encryption processes.

Jan 14

Splunk Research

Detection: Auto Admin Logon Registry Entry | Splunk Security Content

This activity is significant because it was observed in BlackMatter ransomware attacks to maintain access after a safe mode reboot, facilitating further encryption.

Jan 14

Splunk Research

Detection: Add DefaultUser And Password In Registry | Splunk Security Content

This activity is significant because it is associated with BlackMatter ransomware, which uses this technique to automatically log on to compromised hosts and continue encryption after a safe mode boot.

Jan 12

Splunk Research