It’s alive!

**Executive summary:** This report analyzes the BlackMatter ransomware (version 1.2), detailing its Windows and Linux/ESXi capabilities, multithreaded I/O-completion-port encryption using Salsa20 and RSA-1024, encrypted configuration and obfuscation methods, operational features (UAC bypass, AD enumeration, credential-based authentication attempts, service termination, shadow copy deletion), observed indicators (paymenthacks.com / mojobiden.com domains and sample credentials), and concludes BlackMatter is a sophisticated successor or close relative of DarkSide/REvil with active use in attacks and practical mitigation guidance.