[MART] - Daily Diary #382 - BlackMatter Ransomware Announces Retirement

[CTAS-MAT]

Hello,
I hope everyone is doing well!

Below is the entry for today.

11/03/2021 - Diary entry #382

In our Daily Diaries #327 and #373, we covered BlackMatter, a ransomware that operates using the well-known double-extortion technique. BlackMatter was believed to be a successor of DarkSide, that went dark after the Colonial Pipeline attack.

This week, on November 1st, BlackMatter announced on their Russian website that they were shutting down their operations, following pressure from local authorities. According to the message, their operation would be shut down within 48 hours.

BlackMatter wall-of-shame is one of the many monitored by our team's ransom tracker, and even after the announcement, the platform is still online, hosting stolen data from affected companies.

It's not clear if this is related to the recent international efforts into fighting ransomware, as seen with REvil, covered in our Daily Diary #377. Despite the announcement, it's very unlikely that all of its members retire completely. The same way DarkSide retired and BlackMatter was created, a new ransomware operation can rise from the remaining members of BlackMatter in the next months.

Kind Regards,


[https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png]<https://www.appgate.com/>

[https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png]<https://www.linkedin.com/company/appgate-security/>     [https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png] <https://twitter.com/AppgateSecurity>   [https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png] <https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ>



Felipe Duarte Domingues
Security Researcher
Appgate

E: felipe.duarte at appgate.com<mailto:felipe.duarte at appgate.com>
O: +55 19 98840 2509

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/mart/attachments/20211103/c6dc11f4/attachment.htm>