Skip to navigation

Threat reportRansomwareTL-2026-5291

BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass)

highMONITORING

BlackMatter is a ransomware-as-a-service family first seen in July 2021 and assessed as a possible DarkSide rebrand. Reverse engineering of v2.0 shows RSA-1024 plus modified ChaCha20 file encryption, an aPLib-compressed encrypted config, and a UAC bypass through the ICMLuaUtil COM object. First disclosed .

Key facts for BlackMatter v2.0 ransomware

IdentifiersTL-2026-5291
Also known asBlackMatter v2.0
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows (workstations and servers, including Active Directory domains and Exchange mailbox stores); VMware ESXi (Linux variant of BlackMatter)
AttributionBlackMatter (low confidence)
MalwareDarkSide (Windows), Darkside, LockBit, Sodinokibi
MITRE ATT&CK techniquesT1027.007 Dynamic API Resolution, T1036 Masquerading, T1070.004 File Deletion, T1078.002 Domain Accounts, T1134.001 Token Impersonation/Theft, T1135 Network Share Discovery, T1489 Service Stop, T1490 Inhibit System Recovery, T1491.001 Internal Defacement, T1547.001 Registry Run Keys / Startup Folder, T1548.002 Bypass User Account Control, T1559.001 Component Object Model and 3 more in the attack flow
MotivationFINANCIAL
Target sectorshealth, telecoms, banking, finance, education, government administration, critical infrastructure, architecture
Target regionsunited states of america
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for BlackMatter v2.0 ransomware

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5291 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BlackMatter ICMLuaUtil COM UAC Bypass via DllHost Elevation Moniker — Exploitation

Detects a child process spawned by the dllhost.exe COM surrogate carrying the ICMLuaUtil CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7. BlackMatter v2.0 (TL-2026-5291) masquerades as dllhost.exe via PEB edit, calls CoGetObject with the Elevation:Administrator!new moniker and runs ICMLuaUtil ShellExec to relaunch itself elevated before terminating the original process. The elevated relaunch is the pre-encryption privilege-escalation step.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1548.002, T1559.001, T1036
  • Data sources: sysmon, windows_security, DeviceProcessEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\dllhost.exe" ParentCommandLine="*3E5FC7F9-9A51-4367-9063-A120244FBEC7*" NOT (Image="*\\dllhost.exe" OR Image="*\\conhost.exe")
| eval elevated=if(IntegrityLevel="High" OR IntegrityLevel="System","yes","no")
| table _time host User ParentImage ParentCommandLine Image CommandLine IntegrityLevel elevated Hashes

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'dllhost.exe'
| where InitiatingProcessCommandLine has '3E5FC7F9-9A51-4367-9063-A120244FBEC7'
| where FileName !in~ ('dllhost.exe', 'conhost.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, FolderPath, ProcessCommandLine, ProcessIntegrityLevel, SHA256

Sigma

title: BlackMatter ICMLuaUtil COM UAC Bypass via DllHost Elevation Moniker
id: 7c1d3a52-5e0b-4f6a-9a41-2b8e6d0c91f3
status: experimental
description: "Detects a child process launched by the dllhost.exe COM surrogate for CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7 (ICMLuaUtil), the auto-elevation UAC bypass used by BlackMatter v2.0 (TL-2026-5291)."
references:
  - https://us-cert.cisa.gov/ncas/alerts/aa21-291a
  - https://www.chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.privilege-escalation
  - attack.t1548.002
  - attack.execution
  - attack.t1559.001
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\dllhost.exe'
    ParentCommandLine|contains: '3E5FC7F9-9A51-4367-9063-A120244FBEC7'
  filter_main:
    Image|endswith:
      - '\dllhost.exe'
      - '\conhost.exe'
  condition: selection and not filter_main
falsepositives:
  - Other tooling that legitimately uses the CMSTPLUA/ICMLuaUtil elevated COM object
  - Software installers that auto-elevate through the same COM class
level: high

Known false positives:

  • Legitimate software or admin tooling that uses the ICMLuaUtil/CMSTPLUA elevated COM object to launch installers
  • Red-team or pen-test exercises using UACMe-style COM elevation techniques

Tuning notes: Allow-list known installer or management binaries that are legitimately elevated through this CLSID in your estate. Alert at critical severity when the child image runs from a user-writable path (AppData, Temp, Downloads) or carries -path, -safe or -wall arguments.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • BlackMatter v2.0 Sample Hash and -path/-safe/-wall Command-Line Execution — Exploitation · unlock with TL Creds
  • BlackMatter Winlogon AutoAdminLogon and Random-Name RunOnce Persistence — Post-Exploitation · unlock with TL Creds
  • BlackMatter SMB Share Fan-Out from Non-System Binary — Lateral Movement · unlock with TL Creds
  • BlackMatter Ransom Note <EXTENSION>.README.txt Creation — Impact · unlock with TL Creds
  • BlackMatter C2 Domain DNS Resolution ([indicator], [indicator]) — C2 · unlock with TL Creds
  • BlackMatter HTTP C2 Beacon via Hardcoded AppleWebKit/587.38 User-Agent — C2 · unlock with TL Creds
  • BlackMatter Safe-Mode Reboot via bcdedit/bootcfg safeboot — Post-Exploitation · unlock with TL Creds
  • BlackMatter Shadow Copy Deletion and Backup Service Stop — Impact Preparation · unlock with TL Creds

Indicators of compromise for BlackMatter v2.0 ransomware

As of 2026-11-05, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5291.

Sample indicators (3 of 16)

  • Domain: mojobiden[.]com
  • URL: hxxp://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid[.]onion
  • File hash: 520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

16 indicators of compromise · unlock with TL Creds. Compare plans

How BlackMatter v2.0 ransomware works

BlackMatter emerged in late July 2021, shortly after DarkSide and REvil dropped out of public view. Its developers describe it as a combination of LockBit, DarkSide and REvil. Group-IB's analysis points instead to a shared development lineage with DarkSide: both families use an RSA-1024 public key to protect per-file key material, and Group-IB notes that BlackMatter, unlike its predecessors, does not perform CIS-country checks. CISA, the FBI and NSA published joint advisory AA21-291A on 2021-10-18, which assesses BlackMatter as a possible rebrand of DarkSide and maps its behavior to MITRE ATT&CK. Windows and Linux (including ESXi) variants exist, and the group later announced a shutdown citing pressure from authorities.

The Windows v2.0 sample analyzed by Chuong Dong (MD5 50c4970003a84cab1bf2634631fe39d7) hides its behavior with several layers. APIs are resolved dynamically through hash lookup and trampoline calls. Strings are stored as encrypted stack bytes and decrypted by XOR with a constant. Target lists are compared by a one-way hash (sum of bytes rotated right by 13) rather than by literal strings. The configuration is aPLib-compressed and encrypted and carries behavior flags (ENCRYPT_LARGE_FILE_FLAG, CREATE_MUTEX_FLAG, ATTEMPT_LOGON_FLAG, MOUNT_VOL_AND_ENCRYPT_FLAG, NETWORK_ENCRYPT_FLAG, TERMINATE_PROCESSES_FLAG, STOP_SERVICES_AND_DELETE_FLAG, SEND_DATA_TO_SERVER_FLAG, PRINTER_PRINT_RANSOM_NOTE_FLAG). It also carries an RSA public key, a 16-byte AES key for C2 data, a 16-byte company/victim ID, and hashed avoid-lists for folders, files, extensions and computer names. Further fields hold the process-kill list (31 entries), the service-kill list (8 entries), the C2 URL list and the ransom note.

Pre-encryption: if the process is not elevated, it masquerades as dllhost.exe by editing the PEB, calls CoGetObject with the elevation moniker for CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7} to obtain ICMLuaUtil, and runs its ShellExec method to relaunch with elevated rights, then terminates the original process. It tries to duplicate the Explorer.exe token and falls back to a svchost.exe token. It can parse supplied credentials in the form username@domain:password and check domain-admin membership. For safe-mode operation (-safe) it sets AutoAdminLogon and the Winlogon credential values, adds a RunOnce entry with a random name, and runs bcdedit /set {current} safeboot network (bootcfg on Windows XP). It deletes Volume Shadow Copies through WMI (SELECT * FROM Win32_ShadowCopy followed by IWbemServices::DeleteInstance), stops and deletes services through the Service Control Manager, kills listed processes, and uses the Restart Manager API to release files held by other processes. It wipes the per-user folders in $RECYCLE.BIN.

Encryption uses an I/O completion port thread pool and a four-state machine, with 1 MiB read chunks and a 132-byte footer holding the RSA-encrypted ChaCha20 matrix and a checksum. The ChaCha20 implementation is a modified version of the CryptoPP SIMD code. Database-type files (.mdf, .ndf, .edb, .mdb, .accdb) are encrypted in chunks. The extension is derived from the victim MachineGuid through three hashing rounds, with Base64 characters replaced (+ to x, / to i, = to z). The ransom note is named <EXTENSION>.README.txt. Network reach comes from Active Directory/LDAP host enumeration and NetShareEnum, skipping IPC$, ADMIN$ and $c$ shares, and from Exchange mailbox paths. A run-once mutex named Global\<MD4(MachineGuid)> prevents double execution. Before encryption the sample POSTs AES-encrypted JSON host metadata (hostname, OS, user, language, disk info) to its C2 using the User-Agent AppleWebKit/587.38 (KHTML, like Gecko), and after encryption it reports file statistics. The -wall switch renders the ransom text to a BMP, sets it as the wallpaper (WallpaperStyle 10) and prints the note on the default printer. Command-line arguments are -path <dir>, -safe and -wall.

Source-bound limits: the source article is from 2021 and no CVEs or CVSS are cited. Severity is analyst-assigned. Initial access, data theft and affiliate tradecraft are not described in the sources reviewed, and no MITRE mapping of intrusion-phase behavior is claimed beyond what the malware analysis shows. BeaconBeagle was unreachable (HTTP 502) during research, so there is no C2 correlation data.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.007 Dynamic API Resolution; T1036 Masquerading; T1070.004 File Deletion

stealth

T1078.002 Domain Accounts

Privilege Escalation

T1134.001 Token Impersonation/Theft; T1548.002 Bypass User Account Control

Discovery

T1135 Network Share Discovery; T1614.001 System Language Discovery

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1491.001 Internal Defacement

Persistence

T1547.001 Registry Run Keys / Startup Folder

Execution

T1559.001 Component Object Model

Command and Control

T1573.001 Symmetric Cryptography

defense-impairment

T1688 Safe Mode Boot

Remediation for BlackMatter v2.0 ransomware

Immediate actions

  • Block mojobiden.com and paymenthacks.com at DNS and web proxy and alert on any prior resolution
  • Hunt for the SHA256/MD5 hashes and for the .README.txt ransom note pattern across endpoints
  • Alert on bcdedit /set {current} safeboot network and on AutoAdminLogon/DefaultPassword Winlogon changes outside change windows
  • Alert on WMI Win32_ShadowCopy deletions and on mass service stops of backup, VSS, SQL and Exchange services

Workarounds

  • Set UAC to Always Notify and remove local admin rights from standard users to blunt the ICMLuaUtil auto-elevation path

Longer-term hardening

  • Enforce multifactor authentication on remote access and privileged accounts
  • Keep offline, isolated backups and test restores
  • Deploy EDR with behavioral ransomware detection, including COM elevation moniker abuse by a process masquerading as dllhost.exe
  • Protect email against phishing and keep systems patched
  • Restrict network share exposure and limit domain admin credential reuse

Affected and fixed versions

  • Microsoft — Windows (workstations and servers, including Active Directory domains and Exchange mailbox stores)
    Vulnerable versions: Windows XP and later per sample safe-mode handling
  • VMware — ESXi (Linux variant of BlackMatter)
    Vulnerable versions: Not specified in sources

Timeline of BlackMatter v2.0 ransomware

  • DarkSide RaaS becomes active (September 2020 through May 2021, per CISA); locked-ioc-16 is later assessed as a possible rebrand. Day is approximate, month per CISA.
  • locked-ioc-16 RaaS becomes active per Group-IB; first confirmed victim is a U.S. architecture firm.
  • Jan G. publishes an API hashing analysis that the locked-ioc-16 reverse-engineering write-up cites for its dynamic API resolution.
  • Chuong Dong publishes the locked-ioc-16 v2.0 reverse-engineering analysis (sample SHA256 520bd9ed...fc42e57).
  • CISA, FBI and NSA publish joint advisory AA21-291A on locked-ioc-16, with ATT&CK mapping, IOCs and mitigation guidance.
  • locked-ioc-16 operators post a message on the back end of their RaaS site stating they are shutting down, citing pressure from local authorities (screenshot shared via VX-Underground). Press noted Emsisoft had quietly built a decryptor and given it to victims.
  • Security press (TechCrunch, Security Affairs, The Register) reports the locked-ioc-16 shutdown claim; experts question whether the operators have truly ceased activity.

Sources cited for BlackMatter v2.0 ransomware

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats