{
  "family": "black",
  "sample_count": 329,
  "category": "ransomware",
  "description": "Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterprise ransomware family. Operating with advanced evasion techniques, Black utilizes Salsa20 and RSA public-key encryption to rapidly lock files across local drives and accessible network shares. The ransomware actively terminates critical database, virtualization, and endpoint security processes, purges Volume Shadow Copies using vssadmin, deletes system backups, and drops ransom notes instructing victims to negotiate through Tor payment portals under threat of data exfiltration and public disclosure.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Black",
    "Ransomware.BlackMatter",
    "Trojan-Ransom.Win32.Black",
    "Win32/Black.Ransomware",
    "BlackMatter.Ransom"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Black ransomware threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Black is an enterprise double-extortion ransomware family that encrypts network files and demands cryptocurrency payments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Black ransomware encrypt enterprise data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses a hybrid Salsa20 and RSA encryption routine to encrypt local volumes and network shares with multi-threaded speed."
      }
    },
    {
      "@type": "Question",
      "name": "What recovery inhibition steps are taken by Black?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to purge Volume Shadow Copies and terminates backup and database services."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been weaponized to distribute Black?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors delivering Black have exploited enterprise vulnerabilities including CVE-2020-1472 (Zerologon) and CVE-2021-34527."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations recover from Black ransomware attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate all network segments immediately, restore systems from immutable offline backups, and avoid paying the extortion ransom."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1059.003",
    "T1071.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "type": "Generic",
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2021,
  "lineage": {
    "derived_from": [
      "DarkSide Ransomware Codebase"
    ],
    "variants": [
      "BlackMatter v1.0",
      "BlackMatter v2.0",
      "Win32/Black.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2020-1472",
    "CVE-2021-34527"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate all corporate network segments and disconnect shared storage volumes immediately to halt active encryption.",
    "Kill active ransomware processes and disable compromised domain controller accounts.",
    "Preserve encrypted disk images, ransom notes, and network telemetry for incident response forensics.",
    "Restore critical infrastructure systems from immutable, air-gapped backups after verifying environment cleanliness."
  ],
  "what_to_avoid": [
    "Do not pay the extortion demand, as payment does not guarantee decryption and funds further criminal activity.",
    "Avoid rebooting domain controllers during active encryption without taking physical RAM snapshots."
  ],
  "iocs": {
    "file_hashes": [
      "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f",
      "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a"
    ],
    "delivery": [
      "Compromised domain credentials and lateral movement exploiting CVE-2020-1472 Zerologon",
      "Initial access brokered via phishing lures and vulnerable VPN gateways"
    ],
    "persistence": [
      "Modified desktop background displaying ransom notice",
      "Scheduled task configured to restart encryption routines on remaining storage volumes"
    ]
  },
  "sources": [
    {
      "name": "CISA Advisory - BlackMatter Ransomware Technical Details",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-291a"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Black",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Black"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2020-1472",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}