Listen to this Post
A Major Blow to BlackLock’s Operations
In a rare case of “hacking the hackers,” cybersecurity researchers from Resecurity have successfully infiltrated the infrastructure of the notorious ransomware group BlackLock. This breakthrough has unveiled critical insights into the group’s inner workings, including operational failures, security vulnerabilities, and key members’ activities.
BlackLock, a rebranded version of the Eldorado ransomware syndicate, has quickly become one of the most aggressive ransomware groups in 2025, targeting sectors such as technology, finance, manufacturing, and retail. The group’s data leak site (DLS), used to expose and extort victims, was found to have a security flaw that allowed researchers to extract sensitive internal data, including credentials, server commands, and network details.
Key Findings from the Investigation
1. Security Flaw in
- A misconfiguration in the DLS exposed real-world IP addresses associated with BlackLock’s infrastructure, revealing that their hidden services on the TOR network had vulnerabilities.
- This flaw enabled researchers to retrieve command histories, exposing major operational security (OPSEC) failures by the group.
2. Ransomware Evolution and Victim Targeting
- BlackLock has been actively recruiting affiliates to spread its malware, with a notable increase in attacks since January 2025.
- The group has targeted at least 46 victims across multiple countries, including the U.S., U.K., France, Canada, and Brazil.
3. Use of Cloud Storage for Stolen Data
- Researchers discovered that BlackLock operators use Rclone to transfer exfiltrated data to MEGA cloud storage.
- At least eight disposable MEGA accounts, created with YOPmail addresses, were linked to their operations.
4. Connections to Other Ransomware Groups
- A technical analysis of BlackLock’s ransomware strain revealed similarities with DragonForce, another ransomware family previously observed in Saudi Arabia.
- Despite coding differences (DragonForce uses Visual C++ while BlackLock is written in Go), the ransom notes and attack methods showed striking overlaps.
5. Infighting and Possible Takeover
- BlackLock’s infrastructure was defaced by DragonForce on March 20, 2025, likely using the same LFI vulnerability that Resecurity exploited.
- A day before, a separate ransomware project, Mamona, linked to BlackLock’s main operator known as “$$$,” also suffered a similar attack.
- It remains unclear if DragonForce has merged with BlackLock or taken control of its affiliate network, signaling possible consolidation in the ransomware market.
What Undercode Says:
The infiltration of BlackLock represents a significant victory for cybersecurity professionals, demonstrating that even the most elusive ransomware groups can be exposed through technical ingenuity. However, this incident also reveals several key trends in the evolving landscape of cybercrime:
1. Increasing Complexity of Ransomware Operations
BlackLock’s tactics, including cloud-based exfiltration, affiliate networks, and recruitment of traffers, highlight the professionalization of ransomware. Modern groups operate like businesses, complete with structured networks, partnerships, and even internal conflicts.
2. The Rise and Fall of Ransomware Brands
The swift rebranding of Eldorado into BlackLock, followed by the emergence of Mamona, and now the potential takeover by DragonForce, reflects how ransomware groups adapt to law enforcement pressure and competition. A ransomware brand may disappear, but its operators and tactics persist under new names.
3. OPSEC Failures Are a Major Weakness
Despite their expertise in cybercrime, ransomware groups often make critical security mistakes. BlackLock’s reliance on poorly configured infrastructure and insecure cloud storage played a key role in its downfall. This serves as a reminder that no cybercriminal group is invulnerable.
4. Cybercriminals Are Fighting Each Other
The defacement of BlackLock’s infrastructure by DragonForce suggests internal power struggles within the cybercriminal ecosystem. Ransomware groups not only battle law enforcement but also compete with each other for dominance, sometimes leading to sabotage.
5. Ethical Hacking as a Countermeasure
The success of Resecurity in infiltrating BlackLock demonstrates the potential of ethical hacking and proactive threat hunting. By identifying security flaws in cybercriminal infrastructure, defenders can disrupt operations and protect potential victims before attacks escalate.
This event marks a significant shift in the cybersecurity battle: rather than simply responding to attacks, researchers are now taking the fight directly to the criminals. While ransomware remains a persistent threat, these countermeasures are proving that cybercriminals are not as untouchable as they believe.
Fact Checker Results:
- BlackLock’s rebranding from Eldorado is confirmed, with documented evidence linking past and present activities.
- The LFI vulnerability in the DLS was exploited by both researchers and rival hackers, reinforcing its legitimacy as a critical security flaw.
- DragonForce’s attack on BlackLock is verified, but their exact relationship remains unclear—whether it was a hostile takeover or a strategic merger.
References:
Reported By: https://thehackernews.com/2025/03/blacklock-ransomware-exposed-after.html
Extra Source Hub:
https://www.discord.com
Wikipedia
Undercode AI
Image Source:
Pexels
Undercode AI DI v2
