VERY IMPORTANT

On November 3, BlackMatter gang announced it was shutting its Ransomware-as-a-Service program due to the "pressure from the authorities". However, it doesn't mean that BlackMatter's affiliates will stop malicious activity. They will most likely join other RaaS programs. In addition, this might just be an attempt to have a fresh start under a different name. Just like BlackMatter was a rebranding of DarkSide, a new successor may appear soon. Therefore, given the similarities that we observed between DarkSide and BlackMatter ransomware back in August, it's important to be aware of the latest ransomware versions' features: malware configuration, encryption mechanisms in use etc.