BlackLock
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
BlackLock is a ransomware group established around March 2024, operating under a RaaS model and actively recruiting affiliates. The ransomware is developed in Go, enabling cross-platform attacks on Windows, Linux, and VMware ESXi environments, and employs ChaCha20 for file encryption. BlackLock appends encryption keys and metadata to files for decryption post-ransom payment and utilizes a covert method to delete Volume Shadow Copy Service data to hinder recovery efforts. The group has been linked to operational failures due to significant OPSEC mistakes, including a breach of its leak site that exposed internal data.
Source-reported aliases: El Dorado, BlackLocks, Eldorado, Mamona, GLOBAL GROUP. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://asec.ahnlab.com/en/90175/
https://cofense.com/blog/from-payment-plan-to-ransomware-inside-a-global-group-attack
https://exchange.xforce.ibmcloud.com/report/details/guid:5689a0200c31471e9cf96949cd00c12c
https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service