BlackMatter ransomware claims to be shutting down due to police pressure

guest · Nov 3, 2021

BlackMatter ransomware claims to be shutting down due to police pressure
November 3, 2021
https://www.bleepingcomputer.com/ne...s-to-be-shutting-down-due-to-police-pressure/

The BlackMatter ransomware is allegedly shutting down its operation due to pressure from the authorities and recent law enforcement operations.

BlackMatter operates a private ransomware-as-a-service (RaaS) website that affiliates can use to communicate with the core operators, open support tickets, and receive new ransomware builds.
Click to expand...

Today, security research group VX-Underground was sent a screenshot of a message allegedly posted by the BlackMatter operators on November 1st on the RaaS website. This post warns affiliates that the ransomware operation was shutting down in 48 hours.

"Due to certain unsolvable circumstances associated with pressure from the authorities (part of the team is no longer available, after the latest news) - project is closed. [...]"
It is unclear what "latest news" is referring to, but the missing team members could be related to a recent international law enforcement operation arresting twelve individuals linked to 1,800 ransomware attacks in 71 countries.
Click to expand...

If this post is legitimate and BlackMatter is shutting down its operation, it does not mean that the threat actors will no longer extort existing victims.

Based on the post, the RaaS site will allow affiliates to receive decryptors for existing victims so that they can continue extorting victims on their own.
Click to expand...

guest · Nov 3, 2021

BlackMatter ransomware moves victims to LockBit after shutdown
November 3, 2021
https://www.bleepingcomputer.com/ne...ware-moves-victims-to-lockbit-after-shutdown/

With the BlackMatter ransomware operation shutting down, existing affiliates are moving their victims to the competing LockBit ransomware site for continued extortion.

This morning, news broke that the BlackMatter ransomware gang is shutting down after members have gone missing and increased pressure by law enforcement.
While BlackMatter's infrastructure is still live, BleepingCompuer has learned that affiliates are moving existing victims to the LockBit ransomware negotiation site.
Click to expand...

At these LockBit negotiation pages, the BlackMatter affiliates continue to negotiate with victims to receive a ransom payment.
The gang has also been editing their existing posts on forums and asking moderators to delete them.

While BlackMatter will likely rebrand and return as a new ransomware operation, their partnership with LockBit may hurt them in the long run as they lose experienced affiliates.
Click to expand...

Log in or Sign up

BlackMatter ransomware claims to be shutting down due to police pressure

guest Guest

guest Guest

Log in or Sign up

BlackMatter ransomware claims to be shutting down due to police pressure

guest Guest

guest Guest

Useful Searches