BlackLock
Also known as El Dorado, BlackLocks, Eldorado, Mamona, GLOBAL GROUP
BlackLock is a ransomware group established around March 2024, operating under a RaaS model and actively recruiting affiliates. The ransomware is developed in Go, enabling cross-platform attacks on Windows, Linux, and VMware ESXi environments, and employs ChaCha20 for file encryption. BlackLock appends encryption keys and metadata to files for decryption post-ransom payment and utilizes a covert method to delete Volume Shadow Copy Service data to hinder recovery efforts. The group has been linked to operational failures due to significant OPSEC mistakes, including a breach of its leak site that exposed internal data.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://asec.ahnlab.com/en/90175/
- https://reliaquest.com/blog/threat-spotlight-inside-the-worlds-fastest-rising-ransomware-operator-blacklock/
- https://www.resecurity.com/blog/article/blacklock-ransomware-a-late-holiday-gift-with-intrusion-into-the-threat-actors-infrastructure
- https://cofense.com/blog/from-payment-plan-to-ransomware-inside-a-global-group-attack
- https://exchange.xforce.ibmcloud.com/report/details/guid:5689a0200c31471e9cf96949cd00c12c
- https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service
- https://www.ransomlook.io/group/mamona
- https://www.ransomlook.io/group/blacklocks
- https://www.ransomlook.io/group/el%20dorado
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.