What other aliases and vendor names is DarkSide / BlackMatter known by?

DarkSide / BlackMatter is tracked across the cybersecurity industry by multiple aliases, including: DarkSide, BlackMatter, Carbon Spider.

What are the primary motivations and sponsors of DarkSide / BlackMatter?

DarkSide / BlackMatter operates from Russia with primary motivation categorized as Financial gain (ransomware), sponsored or affiliated with Financially motivated criminal group.

DarkSide / BlackMatter

▲ High Threat Russia

Primary Aliases: Carbon Spider DarkSide BlackMatter

Sponsor / State Affiliation Financially motivated criminal group

Primary Motivation Financial gain (ransomware)

Active Timeline 2020 – Present

Confidence Rating 70% (Grounded)

Colonial Pipeline attack (2021) causing US fuel shortage, rebranded to BlackMatter after shutdown

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Energy Industrial Manufacturing Healthcare

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

📥 Download Navigator JSON

Exfiltration & Impact 1

T1485 Double extortion

↗

Operational Techniques 4

T1000 RaaS affiliate model

↗

T1000 ESXi encryption

↗

T1000 Active Directory exploitation

↗

T1000 Legitimate tool abuse

↗

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

No recent breaking campaign alerts recorded in the FlagThis threat database.

Copied to clipboard

LINK COPIED TO CLIPBOARD

DarkSide / BlackMatter

⚔️ Weaponized CVE Matrix (0)

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

📰 Verified Campaigns & Intelligence Archive

SHARE INTELLIGENCE WIRE