BlackLock ransomware has emerged as one of the most notorious cybersecurity threats of 2025, compromising more than 40 organizations within just two months.

The fast-rising ransomware group has targeted victims across multiple sectors, with construction, real estate, and technology industries bearing the brunt of these sophisticated attacks.

Operating as a Ransomware-as-a-Service (RaaS) platform, BlackLock has quickly positioned itself as a dominant force in the cybercriminal ecosystem through its advanced encryption techniques and aggressive targeting strategies.

According to recent attack data, BlackLock has conducted precisely 48 attacks in the first two months of 2025, demonstrating an alarming operational tempo.

The group’s tactics involve encrypting critical organizational data and demanding substantial ransoms for decryption keys, while simultaneously threatening to publish stolen information on their dedicated leak site if demands aren’t met.

DarkAtlas Security researchers identified that BlackLock is actually a rebranded version of the previously known Eldorado ransomware group.

“After facing increased scrutiny from law enforcement, the Eldorado operators have resurfaced under the BlackLock banner with a refined operational model and enhanced capabilities,” noted the DarkAtlas Research Team in their latest threat report.

The ransomware employs sophisticated cross-platform capabilities, using Golang to execute attacks on both Windows and Linux systems.

Unlike many competitors who rely on leaked builder sources, BlackLock developers have created their own malware from scratch, indicating a high level of technical expertise within the group.

BlackLock’s encryption process (Source – DarkAtlas)

This encryption process transforms files by adding random character strings and appends similarly randomized extensions, creating the distinctive pattern seen in affected systems.

Technical Operations and Infection Chain

The infection process begins when BlackLock operators gain access to target networks, often through compromised credentials or vulnerabilities in internet-facing applications.

Once inside, the ransomware encrypts files using ChaCha20 for file content and RSA-OAEP for key encryption, allowing it to attack files on shared networks via SMB protocols.

After encryption completes, victims find a ransom note titled “HOW_RETURN_YOUR_DATA.TXT” containing payment instructions.

BlackLock’s distribution across sectors (Source – DarkAtlas)

The distribution across sectors shows Technology and Miscellaneous industries suffering the highest proportion of attacks, reflecting the group’s strategic targeting of high-value organizations.

Particularly concerning is BlackLock’s recruitment of “traffers” – specialists who drive malicious traffic and establish initial access points.

These individuals play crucial roles in the early stages of attacks, steering potential victims toward compromise.

The group maintains communication through encrypted Telegram channels, making tracking and attribution challenging for security researchers and law enforcement alike.

Organizations are advised to implement robust backup strategies, network segmentation, and comprehensive endpoint protection to mitigate the growing BlackLock threat.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

The post BlackLock Ransomware Hacked 40+ Organization Within Two Months appeared first on Cyber Security News.