darkmatter

Executive Summary

DarkMatter—also known as the BlackMatter ransomware group—is a medium‑sophistication criminal gang that blends double‑extortion ransomware with persistent espionage tactics. The actors primarily target critical infrastructure and diplomatic entities in the Middle East, leveraging purchased network access, high‑value Remote Access Trojans (RATs), and advanced credential‑dumping before encrypting files and demanding ransom. Their operations blend financially driven attacks with long‑term data exfiltration campaigns, often using custom loaders, backdoors, and legitimate utility abuse to evade defenses and maintain persistence across Windows, Linux, and macOS systems.

Goals & Targeting

The gang’s primary objective is financial gain through ransomware while maximizing leverage via data theft—hence the widespread adoption of a double‑extortion model. They also appear to conduct long‑term espionage on critical infrastructure, especially in telecom and defense sectors, to acquire intellectual property and strategic information that can be leveraged for future high‑profile attacks or ransom negotiation. Their targeting matrix spans sovereign governments, diplomatic embassies, and large industrial enterprises, reflecting a blend of opportunistic ransomware markets with deliberate geopolitical objectives.

Key Capabilities

• Deployable ransomware (BlackMatter, HELLOKITTY, HermeticWiper)
• Backdoor persistence via custom loaders
• Keylogging and screen capture via RATs (DarkComet, Hi‑Zor, HiddenFace)
• Credential dumping and lateral movement (LSASS, SMB/ RDP/ SSH)
• Use of legitimate tunneling tools (ngrok, AnyDesk, Teramind, Time Doctor)
• Rootkit and UEFI bootkit installation
• Data exfiltration via cloud services (Rclone, MEGA, Dropbox)
• Scheduled task and registry-based persistence
• Phishing/spear‑phishing with malicious Office macros or VBS
• Exploit of known CVEs in VPNs, ESXi, and industrial devices

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Between 2022 and 2025 DarkMatter has executed at least a dozen documented campaigns, most prominently the "RoadSweep" and "RobbinHood" attacks on governmental networks in Ukraine, Latvia, and Lithuania. They frequently combine ransomware with data‑staging techniques that pre‑exfiltrate sensitive documents to leak sites or cloud buckets before file encryption. Operational tempo is sustained; campaigns often begin with a rapid spike of phishing emails or VPN brute force attempts followed by lateral movement using stolen credentials and exploitation of known CVEs in both on‑premise and virtualized infrastructure. Victim profiles include telecommunications vendors, diplomatic missions, and defense ministries across the Middle East and Eastern Europe, emphasizing high‑impact targets that can command significant ransom payments. Notable patterns: use of purchased IP blocks or compromised VPNs for initial access; a modular backdoor architecture supporting multiple hosts; deployment of custom PowerShell loaders that enable in‑memory execution; and an emphasis on double‑extortion with automated data exfiltration to public cloud services such as Rclone, MEGA, and Dropbox. The group’s campaigns also reveal lateral movement via RDP/SMB/SSH credentials, the use of legitimate monitoring tools (e.g., Teramind) for persistence, and routine disabling or modification of security controls through registry edits or UEFI rootkits.

IOC Patterns

• Double‑extortion ransomware file‑encryption indicators
• Keylogging and screenshot payload markers
• RAT beacon traffic via custom protocols or ngrok tunnels
• Credential dumping footprints (lsass memory, sam dump)
• Scheduled task persistence signatures
• Rootkit installation artifacts (UEFI, HIDEDRV)
• Cloud‑based exfiltration to Rclone/MEGA endpoints
• VPN brute–force login spikes

Recommended Actions

• Implement and monitor privileged account activity using least‑privilege controls and MFA to mitigate silent privilege escalation.
• Deploy endpoint detection & response systems that alert on in‑memory PowerShell execution, registry modifications (Run keys, InprocServer32) and scheduled task creation for persistence. "Enforce strict macro security"—block Office attachments with scripts or VBA, deploy mail filtering and attachment sandboxing to detect spear‑phishing. Use application whitelisting and restrict the use of legitimate remote‑management tools such as AnyDesk/Teramind; log all installations and enforce vendor approval workflows. Implement network segmentation and tightly control VPN/SMB/SSH access, monitor for brute‑force attacks against these services, and enable multi‑factor authentication where possible. Adopt robust backup and restore plans across physical, virtualized and cloud ecosystems, including snapshot protection and immutable backups to nullify data wipe and ransomware threats. Deploy web filtering or sandboxing solutions that detect malicious URLs associated with known loader sites (e.g., Malvertising, fake App installers) and enforce a strict policy on the use of third‑party cloud storage for exfiltration. Enforce strong patch management across all platforms—especially ESXi hosts, Cisco appliances, and industrial control systems—to block exploitation of known CVEs used by this group.

Suggested Tags