Blacktor: The Low-Profile Ransomware Group
Blacktor is a low-profile ransomware group that has been active since December 30, 2021, operating through a Tor-based leak site at bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion. The group claims four victims across Indonesia, Italy, Venezuela, and the United States, spanning Consumer Services, Financial Services, and Education sectors. It has remained largely absent from public threat-intelligence coverage until now, with no prior CVE or public advisory referenced in this story.
Four Victims, Four Sectors
The four victims are ticketclub-it, bankjatim-co-id, salesplaypos-com, and unexca-edu-ve. They span three sectors: two in Consumer Services, one in Financial Services, and one in Education. All four were discovered on December 30, 2021, roughly four years before this report. None of the victims has a public description attached to their entry on the leak site.
Infostealer Infections Power the Attacks
Hudson Rock confirms that Infostealer infections are the primary entry vector for Blacktor ransomware deployments. The group’s leak site entries include a “Stealer Family Distribution” flag, indicating that victim credentials were harvested by a stealer before Blacktor was executed.
The stealer data appears in the victim credential payloads, where Blacktor extracts the initial access material. This is the same pattern seen in Clop and LockBit operations, where the stealer hands off the session to the ransomware dropper.
Distribution happens through exposed credential URLs that are indexed by search engines. The “External Attack Surface” section on the leak site lists the credential endpoints that were publicly reachable, giving Blacktor a direct path from indexed URL to full system compromise.
Tor Leak Site and YARA Rules
Blacktor operates its data leak site over Tor at bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion. The DLS is the primary interface for victim submissions and public leak previews, with a screenshot available for each entry before the full payload is released.
The group ships a single YARA rule, blacktor.yar, which matches the ransomware binary on disk. It is the same rule used to tag the four victims listed on the leak site, covering the blacktor ransomware family across all four targets.
Key points
- Blacktor ransomware group has 4 total victims on Ransomware.live, active from 2023 to 2026.
- Group uses a Tor-based leak site at bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion.
- Victims span Indonesia, Italy, Venezuela, and the US across Consumer Services, Financial Services, and Education sectors.
- Hudson Rock attributes Blacktor attacks to Infostealer infections, with a YARA rule (blacktor.yar) for detection.
- Group has been active since December 2021 with minimal public threat-intel coverage.