The ransomware group established a sophisticated operational structure, implementing affiliate networks and creating Data Leak Sites (DLS) on the TOR network where they published stolen information from victims unwilling to pay ransoms. Through sophisticated exploitation techniques, researchers gained unprecedented access to the threat actors’ backend systems, allowing them to monitor planned attacks and alert potential victims before data exfiltration occurred. In one case, Resecurity contacted the Canadian Centre for Cyber Security 13 days before planned data publication from a Canadian victim, providing valuable time for defensive measures. The successful exploitation leveraged a Local File Include (LFI) vulnerability in the TOR-hosted Data Leak Site, giving researchers access to configuration files, system logs, and even command history. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The intrusion ultimately contributed to Blacklock’s downfall, as another ransomware group called DragonForce Ransomware publicly exposed the compromise in March 2025, effectively ending Blacklock’s operations. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Their operational rules prohibited targeting victims in BRICS alliance countries and the Commonwealth of Independent States, suggesting possible Eastern European or Chinese connections. By January 2025, the intrusion had yielded over 7TB of compromised data and provided crucial intelligence that helped prevent several high-profile attacks. Their global footprint extended to victims in at least 14 countries, including the United States, United Kingdom, Canada, France, Brazil, and the United Arab Emirates. Blacklock ransomware, also known as “El Dorado” or “Eldorado,” emerged as one of the most aggressive ransomware-as-a-service (RaaS) operations in early 2025. The group rapidly accelerated attacks across multiple sectors including electronics, academia, religious organizations, defense, healthcare, technology, and government agencies. This severe OPSEC failure revealed how the attackers moved stolen data between compromised networks and their infrastructure. In some cases, the threat actors deployed the MEGA client directly on victims’ servers to facilitate covert data exfiltration. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 28 Mar 2025 10:05:19 +0000