BlackMatter: Ransomware Group Seeks Affiliates

This report outlines the emergence of the BlackMatter ransomware group, which is recruiting affiliates on cybercrime forums (XSS.is and Exploit.in) and operating a Tor-hosted leak site; it targets private organizations in the US, Canada, Australia, and the UK with revenues over $100M (excluding healthcare and government), offers to buy network access or recruit affiliates on ransom share terms, and requires deposits from affiliates. The report includes observed forum postings, affiliation/payment models ($3k–$100k for access, $120k deposit for participation), suspected links to DarkSide, and remediation recommendations such as patching, VAPT/red teaming, and endpoint protections.