Blackfield — Ransomware Profile
Blackfield (also tracked as BlackFL or BlackField) is a ransomware and double-extortion operation whose encryptor was first observed in July 2025 and whose dedicated data-leak site appeared in June 2026. The encryptor appends the .BlackFL extension and drops a ransom note named BlackField_ReadMe.txt in which the attackers claim to have wiped all reachable backups, while an updated variant identified in February 2026 also renames files to random strings and alters the desktop and pre-login screen. The group exfiltrates corporate data before encryption and pressures victims by tailoring demands to their finances, offering the stolen data for sale, and charging fees to extend leak deadlines. Its first confirmed victim was Nidec Chaun-Choung Technology Corporation, a Taiwanese subsidiary of Nidec Corporation, from which it demanded 2 million US dollars in June 2026, followed by a claim against the Brazilian manufacturer Redeplast in July 2026. The group's origin and internal structure remain unconfirmed, and no evidence of an affiliate program has been observed.Also tracked as
BlackFL, BlackField
Recent claimed victims
- Redeplast 2026-07-03
- Nidec Chaun-Choung Technology Corporation (CCIC) 2026-06-29
Vendor research
- BlackField (aka BlackFL) Ransomware Symantec (Broadcom) Threat Hunter Team
- Weekly Intelligence Report – 18 July 2025 CYFIRMA
- TRACKING RANSOMWARE : JUNE 2026 CYFIRMA
- BlackFL (BlackField) Ransomware - Decryption, removal, and lost files recovery (updated) PCrisk