[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMukMKhQsbAZ28iPjDQ42N76Lh2iSQkd5oObxEVPWAaQ":3,"$ffEwf29ddFz8dp9WBf0uvoxV0IkXOGqs_gTinIW88fp8":68},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":65,"created_at":66,"updated_at":67,"published_at":28},"blacktor-ransomware-group-claims-4-victims-via-infostealer-infections","Blacktor Ransomware Group Claims 4 Victims via Infostealer Infections","Hudson Rock tracks Blacktor on Ransomware.live with 4 victims active from 2023 to 2026, powered by Infostealer infections.","Blacktor is a low-profile ransomware group with a Tor-based leak site claiming 4 victims across Indonesia, Italy, Venezuela, and the US, driven by Infostealer infections per Hudson Rock.",[10,11,12,13,14],"Blacktor","Ransomware","Infostealer","Hudson Rock","Ransomware.live","# Blacktor Ransomware Group Claims 4 Victims via Infostealer Infections\n\n*Hudson Rock tracks Blacktor on Ransomware.live with 4 victims active from 2023 to 2026, powered by Infostealer infections.*\n\n**Tags:** `Blacktor` `Ransomware` `Infostealer` `Hudson Rock` `Ransomware.live`\n\n> Blacktor is a low-profile ransomware group with a Tor-based leak site claiming 4 victims across Indonesia, Italy, Venezuela, and the US, driven by Infostealer infections per Hudson Rock.\n\n---\n\n## Blacktor: The Low-Profile Ransomware Group\n\nBlacktor is a low-profile ransomware group that has been active since December 30, 2021, operating through a Tor-based leak site at bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion. The group claims four victims across Indonesia, Italy, Venezuela, and the United States, spanning Consumer Services, Financial Services, and Education sectors. It has remained largely absent from public threat-intelligence coverage until now, with no prior CVE or public advisory referenced in this story.\n\n## Four Victims, Four Sectors\n\nThe four victims are ticketclub-it, bankjatim-co-id, salesplaypos-com, and unexca-edu-ve. They span three sectors: two in Consumer Services, one in Financial Services, and one in Education. All four were discovered on December 30, 2021, roughly four years before this report. None of the victims has a public description attached to their entry on the leak site.\n\n## Infostealer Infections Power the Attacks\n\nHudson Rock confirms that Infostealer infections are the primary entry vector for Blacktor ransomware deployments. The group’s leak site entries include a “Stealer Family Distribution” flag, indicating that victim credentials were harvested by a stealer before Blacktor was executed.\n\nThe stealer data appears in the victim credential payloads, where Blacktor extracts the initial access material. This is the same pattern seen in Clop and LockBit operations, where the stealer hands off the session to the ransomware dropper.\n\nDistribution happens through exposed credential URLs that are indexed by search engines. The “External Attack Surface” section on the leak site lists the credential endpoints that were publicly reachable, giving Blacktor a direct path from indexed URL to full system compromise.\n\n## Tor Leak Site and YARA Rules\n\nBlacktor operates its data leak site over Tor at `bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion`. The DLS is the primary interface for victim submissions and public leak previews, with a screenshot available for each entry before the full payload is released.\n\nThe group ships a single YARA rule, `blacktor.yar`, which matches the ransomware binary on disk. It is the same rule used to tag the four victims listed on the leak site, covering the `blacktor` ransomware family across all four targets.\n\n## Key points\n\n- Blacktor ransomware group has 4 total victims on Ransomware.live, active from 2023 to 2026.\n- Group uses a Tor-based leak site at bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion.\n- Victims span Indonesia, Italy, Venezuela, and the US across Consumer Services, Financial Services, and Education sectors.\n- Hudson Rock attributes Blacktor attacks to Infostealer infections, with a YARA rule (blacktor.yar) for detection.\n- Group has been active since December 2021 with minimal public threat-intel coverage.\n\n## Further reading & sources\n\n- [Ransomware.live: blacktor](https:\u002F\u002Fransomware.live\u002Fgroup\u002Fblacktor)\n- [blacktor Ransomware: 4 Victims, Tactics & Intelligence – TheHackerWire](https:\u002F\u002Fthehackerwire.com\u002Fransomware-groups\u002Fblacktor)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fblacktor-ransomware-group-claims-4-victims-via-infostealer-infections.png?v=a26142532f",{"iocs":18,"actors":22,"malware":38,"targets":41,"industries":55},[19],{"type":20,"value":21},"domain","bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion",[23,30,35],{"url":24,"name":25,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Fblacktor","Bl@ckt0r","blacktor","ransomware",null,"financial",{"url":31,"name":32,"slug":33,"type":27,"origin":34,"motivation":29},"\u002Fthreat-groups\u002Fplay","Play","play","Unknown",{"url":36,"name":37,"slug":37,"type":27,"origin":28,"motivation":28},"\u002Fthreat-groups\u002Fclop","clop",[39],{"name":40},"blacktor Ransomware",[42,47,51],{"name":43,"sector":44,"status":45,"geography":46},"ticketclub-it","Consumer Services","claimed","Italy",{"name":48,"sector":49,"status":45,"geography":50},"bankjatim-co-id","Financial Services","Indonesia",{"name":52,"sector":53,"status":45,"geography":54},"unexca-edu-ve","Education","Venezuela",[56,59,62],{"url":57,"name":44,"slug":58},"\u002Findustries\u002Fconsumer-services","consumer-services",{"url":60,"name":49,"slug":61},"\u002Findustries\u002Ffinancial-services","financial-services",{"url":63,"name":53,"slug":64},"\u002Findustries\u002Feducation","education","ransomware_incident","2026-08-26T12:19:09.459639+00:00","2026-10-16T12:29:20.551226+00:00",{"articles":69},[70,81,92,103],{"slug":71,"title":72,"summary":73,"tags":74,"hero_image_url":79,"story_type":65,"created_at":80},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[75,76,77,11,78],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":82,"title":83,"summary":84,"tags":85,"hero_image_url":90,"story_type":65,"created_at":91},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[86,11,87,88,89],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":93,"title":94,"summary":95,"tags":96,"hero_image_url":101,"story_type":65,"created_at":102},"qilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim","Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims","AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.",[97,11,98,99,100],"Qilin","AhnLab ASEC","Manufacturing","US","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fqilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim.png?v=b915ec283d","2026-09-18T07:07:39.952851+00:00",{"slug":104,"title":105,"summary":106,"tags":107,"hero_image_url":112,"story_type":65,"created_at":113},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploits Cisco FMC Zero-Day for Unauthenticated Root RCE","Interlock ransomware is actively exploiting a critical Cisco FMC zero-day (CVE-2026-20131) that allows unauthenticated remote attackers to execute arbitrary Java code as root, with double extortion and custom tooling.",[108,109,110,11,111],"Interlock","Cisco FMC","CVE-2026-20131","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","2026-08-31T07:05:12.614729+00:00"]