Dissecting BlackMatter Ransomware

BlackMatter ransomware — Cyble Research Lab provides a concise technical dissection of the BlackMatter ransomware and actor: compilation and import/API usage, mutex and multi-threaded execution, deletion of volume shadow copy services, file encryption (appending random extensions), ransom notes and wallpaper changes, C2 communications with encrypted system JSON, and listed IOCs (multiple SHA-256 hashes, C2 domains and a TOR contact). The report includes ATT&CK mappings and mitigation recommendations such as MFA, patching, AV protection, and offline backups.