BlackMatter — Ransomware Profile
BlackMatter was a rebrand of DarkSide ransomware, operating briefly in 2021 before shutting down under law enforcement pressure.Also tracked as
DarkSide successor, Coreid
IntelFusions coverage (2)
- Ransomware crew mined crypto in Colombia before encrypting 2026-08-10 · Ransomware
- NightSpire: The Rbfs Rebrand That Went From Data Theft to Double Extortion in Weeks 2026-02-16 · Ransomware
Tools & malware
- BlackMatter Ransomware/Encryptor
- Exmatter Data Exfiltration Tool
Vendor research
- BlackMatter Ransomware (Alert AA21-291A) CISA/FBI/NSA
- BlackMatter ransomware: in-depth analysis & story behind the DarkSide strain Group-IB
- BlackMatter: New Data Exfiltration Tool Used in Attacks Symantec (Threat Hunter Team)
- BlackMatter ransomware emerges from the shadow of DarkSide Sophos
- BlackMatter Ransomware Technical Analysis and Tools from Nozomi Networks Labs Nozomi Networks