Infrastructure Destruction Squad / BLACKNET-00: Ransomware, Firebase and ICS Tooling

This Ransom‑ISAC analysis assesses the Infrastructure Destruction Squad / BLACKNET‑00 ecosystem: a publicly released ransomware builder (functional payload with weak, recoverable repeating‑XOR encryption and durable host artefacts), a Shadow Ghost tool that reliably enumerates exposed Firebase Storage/Firestore/Realtime DB instances, and a TRK‑25 script containing reusable ICS/SCADA reconnaissance, fingerprinting and near‑operational Modbus/S7 routines. The report provides sample hashes, YARA detection rules, defender priorities (remediate exposed OT, audit Firebase rules, hunt for persistent host artefacts), and emphasizes verifying actor claims before escalation due to mixed publicity and uneven technical maturity.