extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

BlackMatter

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under BlackMatter in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

BlackMatter was first seen in July 2021. CISA, FBI, and NSA described it as a possible DarkSide rebrand; extortion.wiki preserves “possible” and does not treat operator continuity as confirmed.

Source name
BlackMatter
Canonical lineage name
BlackMatter
Entity model
operation
First observed
July 2021
Last observed
Date not established
Current status
Not established

Documentary media

First page of the official joint BlackMatter ransomware advisory
Joint BlackMatter ransomware advisoryFirst-page preview of the CISA, FBI, and NSA advisory that describes BlackMatter and preserves the agencies' wording that it was a possible DarkSide rebrand.CISA, FBI, and NSA · published 2021-10-18 · Contextual materialEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedA low-resolution first-page excerpt is used to identify and discuss the underlying official advisory. Agency marks remain only within the unaltered document preview; no general reuse license is claimed.Source: CISA, FBI, and NSA joint advisory AA21-291A.

Known aliases

No source-supported alias is currently recorded. Malware names and actor-group names are not assumed to be equivalent.

Historical timeline

Lineage and relationships

Relationships shown from this actor's perspective
Related actor or familyRelationshipPeriodConfidenceEvidence summarySources
DarkSideoperation Reported former identitysuspected · directed From July 2021 Moderate confidence

CISA, FBI, and NSA describe BlackMatter as a possible DarkSide rebrand. The source does not confirm complete operator continuity.

  • The joint advisory says BlackMatter is a possible rebrand of DarkSide and dates the two operations on either side of May–July 2021.
 CISA, FBI, and NSA

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

None established.

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. BlackMatter RansomwareCISA, FBI, and NSA · government advisory · primary authoritative

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Blackmatter notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Blackmatter. Its 1 archived note is counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter BlackMatter records

Collection: 2 records · 121 messages

BlackMatter negotiation record collection
Participants Source Archive status
20210907 77 BlackMatter, Victim JSON Indexed
20210829 44 BlackMatter, Victim JSON Indexed