threat actor · Origin not attributed
BlackLock
On record in CyberSIXT · MISP Galaxy
Sources name this actor but link nothing to it yet: no CVE, technique or software is on record.
Open BlackLock's actor pageBlackLock is a ransomware group established around March 2024, operating under a RaaS model and actively recruiting affiliates. The ransomware is developed in Go, enabling cross-platform attacks on Windows, Linux, and VMware ESXi environments, and employs ChaCha20 for file encryption. BlackLock appends encryption keys and metadata to files for decryption post-ransom payment and utilizes a covert method to delete Volume Shadow Copy Service data to hinder recovery efforts. The group has been linked to operational failures due to significant OPSEC mistakes, including a breach of its leak site that exposed internal data.
Source: MISP Galaxy. MISP Galaxy threat-actor cluster, by the MISP Project (CC0 1.0).
- Also known as
- El Dorado, BlackLocks, Mamona, GLOBAL GROUP
- Origin
- Not attributed
- On record in
- CyberSIXT · MISP Galaxy
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.