Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Blackwater ransomware

11 victims listed on the Blackwater leak site across 6 countries. Most recent disclosure .

Victims
11
0% of all tracked
Countries
6
Most: China
Sectors
7
Most: Manufacturing
First seen
May 2026
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Blackwater and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Blackwater is a cyber threat actor behind ransomware operations, responsible for at least eleven targeted attacks across six countries, focusing on healthcare with notable victims like Minidoka Memorial Hospital in Idaho.

Who Blackwater is

Blackwater is a ransomware group that first surfaced in early 2026, combining file encryption with data theft and targeting healthcare organizations, with known victims including Minidoka Memorial Hospital in Idaho.

Recorded activity

Disclosures attributed to Blackwater in this database run from May 2026 to August 2026, totalling 11 victims — 0% of everything tracked here. Blackwater has listed victims in 6 countries in this database, most often China, followed by United States and Brazil. The sectors appearing most in its listings are Manufacturing, Professional Services, Energy & Utilities.

YARA detection rules

blackwater.yar 
/*
blackwater ransomware
*/

rule blackwater_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.blackwater"
        description = "Detects blackwater ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "blackwater" ascii nocase
        $name2 = "BLACKWATER" ascii
        $onion  = "blackwater.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Blackwater, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Blackwater has disclosed 11 victims on its leak site, 0% of all ransomware listings tracked in this database. Its earliest disclosure here dates to May 2026.

The group has listed organisations in 6 countries, most often in China (3 victims), followed by United States, Brazil, Argentina.

By industry, its listings concentrate in Manufacturing, Professional Services, Energy & Utilities — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Blackwater is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Blackwater victims 11

Organization Disclosed
www.ptesm.com
PTPortugal
www.amca.org.ar
ARArgentina
www.shalina.com
INIndia
msgas.com.br
BRBrazil
txdkj.com
CNChina
www.utourworld.com
Compass Housing Alliance
USUnited States
Grupo EBD
BRBrazil
Minidoka Memorial Hospital
USUnited States
Shenzhen Gongjin Electronics
CNChina
Tuopu
CNChina

Frequently asked questions

What is Blackwater ransomware?

Blackwater is a ransomware threat group that has claimed 11 victims since its first known activity in May 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Blackwater attacked?

Blackwater has claimed 11 victims in our database, representing 0% of all tracked ransomware attacks. The most targeted countries are China, United States, Brazil, Argentina.

Which countries does Blackwater target?

Blackwater has attacked organizations in 6 countries. The top targeted countries are: China, United States, Brazil, Argentina.

Which industries does Blackwater target?

Blackwater most frequently targets the Manufacturing, Professional Services, Energy & Utilities sectors based on victim disclosures in our database.

Is Blackwater still active?

Blackwater's most recent victim disclosure in our database was on August 24, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.