Introduction
Security researchers have described BlackLock as a “rebranding” of the Eldorado ransomware operation.[Resecurity BlackLock March 25 2025] Unless otherwise noted, this object uses details from the existing “Eldorado Ransomware Operators” Group object.
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- BlackEnergy:
- BLACKCOFFEE:
- Blackshades:
- BlackNix:
- Archelaus Beta:
- BlackHole:
Attribution and Evidence
Information pending cataloguing.