BlackMatter is a ransomware operation that emerged in 2021, widely suspected to be a rebrand or evolution of DarkSide-affiliated actors.
BlackMatter is a ransomware_group tracked across 2 threat clusters and 3 intelligence report mentions on ThreatCluster. First observed November 20, 2025; most recent activity June 10, 2026.
BlackMatter is a ransomware operation that emerged in 2021, widely suspected to be a rebrand or evolution of DarkSide-affiliated actors. It operates with a double-extortion model against Windows networks and has influenced later groups (notably BlackCat/ALPHV) through shared techniques and affiliate-style operations. It remains significant in cybersecurity as a benchmark for early extortion workflows and is referenced in defense-focused analyses and emulation exercises, such as AttackIQ's Ransom Tales, to illustrate attacker tactics against modern defenses.
The SilabRAT, a Remote Access Trojan (RAT), has emerged on dark web forums as a Malware-as-a-Service (MaaS) offering since late 2025, priced at $5,000 per month. Developed by the Russian-speaking actor 'o1oo1', it is…
The article discusses the fifth volume of AttackIQ’s Ransom Tales series, which simulates the tactics of ransomware families REvil, DarkSide, and BlackMatter. These emulations are designed to help organizations validate…
BlackMatter is a ransomware operation that emerged in 2021, widely suspected to be a rebrand or evolution of DarkSide-affiliated actors.
The most recent intelligence report mentioning BlackMatter on ThreatCluster is dated June 10, 2026. Activity was first observed November 20, 2025, giving a tracked span from then to June 10, 2026.
Across ThreatCluster reporting, BlackMatter most frequently co-occurs with APT41, Malware, Ransomware, Trojan, Apt41 Cyber-Espionage Campaign, among 12 tracked related entities.
The most significant recent cluster is “SilabRAT Trojan Targets Cryptocurrency with Session Hijacking Techniques” (2 articles · Updated June 10, 2026). BlackMatter appears across 2 threat clusters in total, listed above with sources.
BlackMatter appears in 3 intelligence report mentions across 2 deduplicated threat clusters, aggregated from 17,000+ monitored sources.