Security shop pwns ransomware gang, passes insider info to authorities

Resecurity discovered and exploited an LFI misconfiguration in the BlackLock ransomware gang’s TOR-based data leak site, recovering server configs, credentials and operator command histories. Using that access they cracked hashes, tracked operator activity, alerted CERT-FR and Canadian authorities to imminent leaks for several victims, and linked BlackLock to other ransomware brands (El Dorado, Mamona, DragonForce) while documenting TTPs such as use of Mega and rclone for exfiltration.