BlackMatter’s primary goal was financial gain through extortion. Their tactics revolved around a double-extortion model:

1. Encrypting Data: They would encrypt critical files and systems, disrupting the victim's operations.

2. Exfiltrating Data: Before encryption, they would steal sensitive data and threaten to leak it publicly if the ransom was not paid.

Their attacks were designed to create maximum pressure on victims, often targeting large, high-revenue corporations that couldn't afford significant downtime.

To achieve their goals, BlackMatter operators employed a variety of techniques that demonstrate a sophisticated understanding of network infiltration and lateral movement.

• Initial Access: They often gained entry by using legitimate remote management software and leveraging compromised user or admin credentials purchased from initial access brokers.

• Discovery: Once inside a network, they used LDAP and SMB protocols to discover all hosts within the Active Directory. This allowed them to map out the entire network for their attack.

• Credential Dumping: The group was known to harvest credentials from the Local Security Authority Subsystem Service (LSASS) to escalate privileges and move laterally across the network.

BlackMatter followed a specific set of procedures to execute their attacks efficiently.

• Malware Deployment: The ransomware was deployed to encrypt both Windows and Linux-based systems, including ESXi virtual machines.

• Network Enumeration: They used tools like NtQuerySystemInformation and EnumServicesStatusExW to enumerate running processes and services, identifying security tools to disable.

• Disabling Defenses: Before deploying the final payload, they would often wipe or reformat backup systems to prevent victims from restoring their data without paying the ransom.

• Ransom Note: After encryption, a ransom note named [random_string].README.txt was dropped into each affected directory, instructing the victim on how to pay the ransom.