// THREAT ACTOR

BLACKMATTER_

Dormant

BLACKMATTER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of BLACKMATTER — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

31 Victims tracked

0 / 3 Active mirrors

2021-09-09 First listing

2021-11-04 Most recent

Victims by year

2021 31

Leak site mirrors

3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion BlackMatter snapshot · 2021-11-04 21:45
supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion snapshot · 2024-12-09 20:13
supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion snapshot · 2024-12-12 11:25

Recent victims

The 50 most recent victims claimed by BLACKMATTER. Total in the index: 31.

Date listed	Victim	Description
2021-11-04	National Beverage
2021-11-04	Keycentrix
2021-11-04	Jobbers Meat Packing Co., Inc.
2021-11-04	Home State Bank
2021-11-04	Armour Transportation Systems
2021-10-04	ZKTeco USA
2021-09-29	crystalvalley
2021-09-21	Bumper to Bumper Autoparts
2021-09-20	LA-Martiniquaise
2021-09-20	JMclaughlin
2021-09-20	CasagrandeGroup
2021-09-20	BCP Securities
2021-09-20	Pramer Baustoffe GmbH
2021-09-20	Ellerboeck
2021-09-20	Citrocasa GmbH
2021-09-20	Actief-Jobmade
2021-09-20	Eisvogel Hubert Bernegger GmbH
2021-09-18	Pulmuone Co., Ltd.
2021-09-17	Modern Testing Services
2021-09-17	northwoods & spectrumfurniture
2021-09-15	EQUITY TRANSPORTATION
2021-09-11	River City Construction
2021-09-09	hhcp.com
2021-09-09	Network Telecom / Enreach
2021-09-09	Pine Labs Pvt
2021-09-09	Kaydon Corporation (SKF Group Brand)
2021-09-09	tastefulselections & WFG
2021-09-09	Middleton Reutlinger
2021-09-09	g-able.com
2021-09-09	Diamond Schmitt
2021-09-09	Trust Capital Funding

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.