Threat Spotlight: Inside the World’s Fastest Rising Ransomware Operator — BlackLock

ReliaQuest's report details the rapid rise of BlackLock (El Dorado), a sophisticated RaaS operator active since March 2024 that uses custom multi-platform ransomware and double extortion; it outlines the group's unusual, researcher-resistant data-leak site, extensive recruitment and operational activity on the RAMP forum, documented attack waves targeting Windows and VMware ESXi (with a Linux variant), and an emerging focus on abusing Microsoft Entra Connect—concluding with detection rules and mitigation guidance for affected organizations.