Blacklock ransomware

Who Blacklock is

BlackLock is a rebranded version of another ransomware group known as Eldorado. It has since become one of the most active extortion syndicates in 2025, heavily targeting technology, manufacturing, construction, finance, and retail sectors.

Recorded activity

Disclosures attributed to Blacklock in this database run from May 2025 to July 2025, totalling 64 victims — 0.3% of everything tracked here. Blacklock has listed victims in 19 countries in this database, most often United States, followed by Canada and Spain. The sectors appearing most in its listings are Business Services, Technology, Construction.

Indicators of compromise

• f392807da3ee1f3e9702ce5fa91d418d

Showing a sample of 1 MD5 on file. Hashes and network indicators published for Blacklock. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
BlackLock ransomware
*/

rule BlackLock_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.blacklock"
        description = "Detects BlackLock ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "BlackLock" ascii nocase
        $s2 = "BLACK-LOCK" ascii nocase
        $s3 = "Reedme.txt" ascii nocase
        $s4 = "blacklock.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Blacklock, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.