Operations of the BlackLock ransomware-as-a-service gang which was poised to be among the most prolific RaaS groups this year despite only emerging last March have been disrupted by Resecurity researchers after exploiting a misconfiguration within the group's data leak site, according to Security Affairs.
Abuse of the leak site's local file include flaw exposed BlackLock's clearnet IP addresses associated with its network infrastructure behind TOR hidden services, as well as other server-side service details, reported Resecurity researchers. Further infiltration of BlackLock, also known as El Dorado Ransomware, also uncovered eight MEGA accounts leveraged by the RaaS operation in managing data stolen from its victims, which include IT providers, healthcare organizations, and government entities around the world. BlackLock has also been associated with the Mamona ransomware gang, which has also shut down operations. However, the DragonForce ransomware gang has picked up the slack, with researchers expecting the group to soon include BlackLock's affiliates.
An In-Depth Guide to Ransomware
Get essential knowledge and practical strategies to protect your organization from ransomware attacks.
The user, operating under the name Sadpainy, released code intended to replicate Stuxnet, the malware that reportedly destroyed a fifth of Iran's uranium enrichment centrifuges.
The malware, which has been active since at least 2023, adopted MQTT for its command-and-control (C2) communications in variants developed between 2024 and 2025, according to a report by Black Lotus Labs.
