Blacklock Ransomware: A Late Holiday Gift with Intrusion into the Threat Actor’s Infrastructure

Resecurity's HUNTER team discovered and exploited a vulnerability in the BlackLock (aka El Dorado/Eldorado) ransomware group's Tor-hosted data leak site, allowing collection of logs, hosting/ISP details, login timestamps and associated MEGA accounts used to store stolen data; this covert intelligence enabled prediction and prevention of some planned attacks and protection of undisclosed victims. The report emphasizes proactive offensive cyber operations combined with threat intelligence as an effective method to disrupt RaaS activities.