BlackLock Ransomware: A New Cross-Platform Threat Spreading Rapidly

BlackLock Ransomware: A New Cross-Platform Threat Spreading Rapidly was analysed by the AhnLab Security Intelligence Center (ASEC), which notes that the group emerged around March 2024 and publicly revealed operations in June 2024 with a Dedicated Leak Site. Initially operating as El Dorado, the gang rebranded to BlackLock around September 2024.

According to ASEC, BlackLock is written in Go, a cross‑platform language, allowing encryption across Windows, Linux and VMware ESXi environments and thereby broadening the attack surface. Most confirmed victims are in the United States, with additional activity seen in South Korea, Japan and other countries, across sectors including public institutions, consulting, education, transportation and hospitality.

The malware supports multiple execution arguments such as -path, -perc and -sort to fine‑tune encryption, and defaults to encrypting the entire local drive if launched without options. It uses XChaCha20 and Elliptic Curve Diffie-Hellman to protect and recover decryption keys, appends key metadata to each file, and deploys a ransom note titled HOW_RETURN_YOUR_DATA.TXT; it also can delete shadow copies via a WMI‑enumerating shellcode, complicating detection.