25:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/3k0jjn7m8jtc5.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/1kn_tf3p-ubex.js"],"ReportDetailWrapper"] 2eb:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 24:T451,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean — Falcon Sandbox Report 61f8e152d40a… — Sample 6eac6d4bce64…","description":"Clean verdict for sandbox report 61f8e152d40a…. 0 malicious and 3 suspicious behavioral indicators across 21 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05/61f8e152d40a5921531a6432","keywords":["Clean","sandbox report","malware analysis","MITRE ATT\u0026CK","6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05"],"about":{"@type":"SoftwareApplication","name":"History-of-REvil.pdf","applicationCategory":"PDF document, version 1.7","identifier":"6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05","additionalType":"Clean sample"},"sandboxEnvironment":"Windows 7 64 bit","behavioralIndicators":{"malicious":0,"suspicious":3,"totalSignatures":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}26:T4d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADY0lEQVR42u2VS08TURiG+ytceVmYGI260gUmaNzJRuMlaBQXYlgYNTEhxI3RmGBwwQJj3BjcqISF8YIYTIyXyKVCBRQskrZaCr1QCvQy05ne4XW+AzOcGaY4rZK48CRPmtOe0+c93/k6tdn+9REMBkEEAgEN9b1QKITp6WmEw2HMzMwwIpEIZmdnMTc3x3A6nfjjAKrY7/drAUhuDEByPsD8/DzcbjdcLlfxEPEtNqwHFIgCTE5OsqBer9c8RFRZLO7d8Feh76RKUQB6TSaT2jWuChDZbIORvFLWdF8vYg1XlubhaWS+jSJaW8PmBaXMGecopJcvYLafoJNHo1EmzWQyEASBVcLn8+lDhJXFRrITXkSOVSH92bE0900gXLET8od3K3OTfTxqACq92kP0nsfj0YcIbrLBSF5pIqn7IyIX6tichPSa+flj6XOltGmqyN0WmO0nSBaLxRCPx5FIJBhUBVEUGVqAKWWxkYxSAd1cCRA4WAH5y7A2N9unY2qqqJx6Qgvg3WiDkdT4d908q/SANPIV/ppqNk+7XTDbx0M/2WJySZJWAniUxesB3XkxuS6AS1m8HtDPzkwuyzLD8pOwp6cH3d3dGr29vYy+vj7Y7Xb09/djYGCA4XA4MDg4iLGxMfZEVMVGeSqVsh6AmskI3a+K2X8EyakB+ZLz8nQ6bT0AfZERtbkI8X0XkpdOQnxwR1dus1Or8pIC8DK+q1WS95ogesYhnq3SiYvJ6alIWA7Ay/im0k7b0Y7kszaI54+vKVbl2WyWYTnAKuHyKbXThkMQDmxH8n7LmmJensvlrAfQyZZPyENCYf8OyCPDlsREPp+3HsAo4yGZPDIE4XAlxJsNlsREoVCwHsAo5CGZeL0e0qNWyJ1PIT1p+62YWFhYsB7AWFYdoQBie7YiNeSA9LAViboaxE8dgdjcBOHWDYi3G1eJicXFResBjGVVkd++RryqEolz1ZDfdCEnS+y0cudzCNeuQmp/jNld23RyEhM0LAfgS0pkgn4IF2uRbG5EdN9uZEVBV2Z2Ygr9yY6cf0onVuUlBVDvUSVRe5qFiB09hLS9Z9X9GkvNS/lhOQB/MiJRfxnxMyeQetWxprSYuOQAvMRMWIq0rAC8yExYirSsAEZZucKyA2Cdhu3/WB6/ADuvDu+77R/qAAAAAElFTkSuQmCC27:T5c7,--type=renderer --primordial-pipe-token=DEBA2291CBD6839526F248A2FC3FC292 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.9.20044 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=DEBA2291CBD6839526F248A2FC3FC292 --renderer-client-id=2 --mojo-platform-channel-handle=1304 --allow-no-sandbox-job /prefetch:128:T5c7,--type=renderer --primordial-pipe-token=37644F1635F10D858635E37EA200D696 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.9.20044 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=37644F1635F10D858635E37EA200D696 --renderer-client-id=3 --mojo-platform-channel-handle=1336 --allow-no-sandbox-job /prefetch:129:T56e,"AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB")2a:T5d6,"AcroRd32.exe" touched "WinInetBroker Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "AcroRd32.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\PROGID") "AcroRd32.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\PROGID") "AcroRd32.exe" touched "Network List Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\INPROCHANDLER") "AcroRd32.exe" touched "Adobe Acrobat Document" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\TREATAS") "AcroRd32.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "AcroRd32.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\INPROCHANDLER32") "AcroRd32.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "AcroRd32.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "AcroRd32.exe" touched "Application Registration" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "RdrCEF.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}")2b:T481,"https://threatpost.com/revil-ransomware-attack-celeb-law-firm/155676/" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin") "http://analyst1.com/blog" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin") "https://blog.emsisoft.com/en/39181/on-the-matter-of-blackmatter/" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin") "https://twitter.com/useanalyst1" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin") "https://sapphirex00.medium.com/revil-aka-sodinokibi-ransomware-operator-interview-" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin") "https://intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin") "https://analyst1.com/blog/dark-web-justice-league" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin") "https://www.youtube.com/watch?v=ZyQCQ1VZp8s&feature=youtu.be" (Based on: "6eac6d4bce64aa383c67aeedec23668889a654023d40f0c148a87bcf5f558f05.bin")2c:T41d,"ReaderMessages" has type "SQLite 3.x database" "ReaderMessages-journal" has type "SQLite Rollback Journal" "data_1" has type "data" "Visited Links" has type "data" "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data" "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type "data" "A9Rpeho4p_14ko7gg_2o4.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)" "urlref_httpsthreatpost.comrevil-ransomware-attack-celeb-law-firm155676" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators" "urlref_httpanalyst1.comblog" has type "HTML document UTF-8 Unicode text with very long lines" "urlref_httpsblog.emsisoft.comen39181on-the-matter-of-blackmatter" has type "HTML document UTF-8 Unicode text with very long lines" "urlref_httpstwitter.comuseanalyst1" has type "HTML document UTF-8 Unicode text with very long lines" "urlref_httpsintel471.comblogdarkside-ransomware-shut-down-revil-avaddon-cybercrime" has type "HTML document UTF-8 Unicode text with very long lines"2d:T75b0,Pattern match: "https://threatpost.com/revil-ransomware-attack-celeb-law-firm/155676/" Pattern match: "http://analyst1.com/blog" Pattern match: "https://blog.emsisoft.com/en/39181/on-the-matter-of-blackmatter/" Pattern match: "https://twitter.com/useanalyst1" Pattern match: "https://sapphirex00.medium.com/revil-aka-sodinokibi-ransomware-operator-interview-" Pattern match: "https://intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime" Pattern match: "https://analyst1.com/blog/dark-web-justice-league" Pattern match: "https://www.youtube.com/watch?v=ZyQCQ1VZp8s&feature=youtu.be" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "https://sapphirex00.medium.com/revil-aka-sodinokibi-ransomware-operator-interview-\nenglish-version-a5cb3e52ff2" Pattern match: "https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f)" Pattern match: "www.google-analytics.com" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/favicon.ico?id=8d0c97e25b562df9b554" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Bold.woff2" Pattern match: "https://www.facebook.com/Emsisoft/" Pattern match: "https://blog.emsisoft.com/wp-content/uploads/2021/10/Limit-your-personal-data-exposure-blog-2.png" Pattern match: "https://schema.org,@graph:[{@type:WebSite,@id:https://blog.emsisoft.com/en/#website,url:https://blog.emsisoft.com/en/,name:Emsisoft" Pattern match: "https://blog.emsisoft.com/en/feed/" Pattern match: "https://blog.emsisoft.com/en/comments/feed/" Pattern match: "https://blog.emsisoft.com/en/39181/on-the-matter-of-blackmatter/feed/" Pattern match: "https://blog.emsisoft.com/wp-content/plugins/wp-socializer/public/css/wpsr.min.css?ver=7.1" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/css/app.css?id=b4ea97ca676990160c80" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/css/blog.css?id=b02142a3506cf02d2e0a&ver=9d69894f99eda12131299229af3d831e" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_blog/dist/css/app.css?id=ff35d9d9124fe64099e6&ver=9d69894f99eda12131299229af3d831e" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/js/jquery-3.5.1.min.js?id=dc5e7f18c8d36ac1d3d4&ver=9d69894f99eda12131299229af3d831e" Pattern match: "https://blog.emsisoft.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.5.4" Pattern match: "https://api.w.org/" Pattern match: "https://blog.emsisoft.com/wp-includes/wlwmanifest.xml" Pattern match: "https://blog.emsisoft.com/?p=39181" Pattern match: "https://blog.emsisoft.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.emsisoft.com%2Fen%2F39181%2Fon-the-matter-of-blackmatter%2F" Pattern match: "https://blog.emsisoft.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.emsisoft.com%2Fen%2F39181%2Fon-the-matter-of-blackmatter%2F&format=xml" Pattern match: "https://blog.emsisoft.com/en/39181/on-the-matter-of-blackmatter/amp/" Pattern match: "www.google-analytics.com/analytics.js','ga" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-WK8DP7" Pattern match: "https://www.emsisoft.com" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/layout/logo.svg?id=c0f87631c419e4c180b8" Pattern match: "https://blog.emsisoft.com/en/" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_blog/dist/images/logo_blog_blue.svg?id=fcc6cfb72907eace5bf4" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-search" Pattern match: "https://blog.emsisoft.com/post-ajax.php?action=top_search" Pattern match: "https://www.emsisoft.com/en/company/about/" Pattern match: "https://www.emsisoft.com/en/protection/comparison/" Pattern match: "https://www.emsisoft.com/en/home/antimalware/" Pattern match: "https://www.emsisoft.com/en/business/businessecurity/" Pattern match: "https://www.emsisoft.com/en/business/businessecurity/#enterprise-security" Pattern match: "https://www.emsisoft.com/en/partner/join/" Pattern match: "https://www.emsisoft.com/en/remediation/" Pattern match: "https://www.emsisoft.com/en/tools/emergencykit/" Pattern match: "https://www.emsisoft.com/ransomware-decryption-tools/" Pattern match: "https://www.emsisoft.com/en/ransomware-recovery-services/" Pattern match: "https://www.emsisoft.com/en/software/cmd/" Pattern match: "https://www.emsisoft.com/en/home/mobilesecurity/" Pattern match: "https://blog.emsisoft.com" Pattern match: "https://blog.emsisoft.com/en/category/emsisoft-news/" Pattern match: "https://blog.emsisoft.com/en/category/enterprise-security/" Pattern match: "https://blog.emsisoft.com/en/category/protection-guides/" Pattern match: "https://blog.emsisoft.com/en/category/malware-lab/" Pattern match: "https://blog.emsisoft.com/en/category/protection-guides/commentaries/" Pattern match: "https://blog.emsisoft.com/en/category/latest-videos/" Pattern match: "https://help.emsisoft.com/en/" Pattern match: "https://support.emsisoft.com/" Pattern match: "https://www.emsisoft.com/en/support/submit/" Pattern match: "https://www.emsisoft.com/en/pricing/" Pattern match: "https://www.emsisoft.com/en/order/partner/" Pattern match: "https://www.emsisoft.com/en/order/renew/" Pattern match: "https://my.emsisoft.com/auth-state.html?lang=en" Pattern match: "https://blog.emsisoft.com/en/category/malware-lab/ransomware/" Pattern match: "https://blog.emsisoft.com/en/author/fw/" Pattern match: "https://blog.emsisoft.com/wp-content/uploads/2021/10/blog-header-BM-2.png" Pattern match: "https://blog.emsisoft.com/wp-content/uploads/2021/10/blog-header-BM.png" Pattern match: "https://blog.emsisoft.com/en/39121/ransomware-profile-blackmatter/" Pattern match: "https://blog.emsisoft.com/en/38577/ransomware-profile-darkside/" Pattern match: "https://pbs.twimg.com/media/E7TuovCXoAcy4lt?format=jpg&name=900x900" Pattern match: "https://blog.emsisoft.com/wp-content/uploads/2021/10/bm_leaksite-730x634.png" Pattern match: "https://www.cisa.gov/critical-infrastructure-sectors" Pattern match: "https://blog.emsisoft.com/wp-content/uploads/2021/10/bm_locked_out-730x696.png" Pattern match: "https://www.emsisoft.com/en/tools/ransomware-recovery/inquire/" Pattern match: "https://secure.gravatar.com/avatar/101c7cbc092a59fa0915beb708449b80?s=127&d=mm&r=g" Pattern match: "https://www.facebook.com/sharer.php?u=https://blog.emsisoft.com/en/39181/on-the-matter-of-blackmatter/" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-facebook" Pattern match: "https://twitter.com/intent/tweet?text=Hitting%20the%20BlackMatter%20gang%20where%20it%20hurts%3A%20In%20the%20wallet" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-twitter" Pattern match: "https://www.linkedin.com/shareArticle?url=https://blog.emsisoft.com/en/39181/on-the-matter-of-blackmatter/&title=" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-linkedin" Pattern match: "https://www.xing.com/spi/shares/new?url=" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-xing" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-envelope" Pattern match: "https://blog.emsisoft.com/en/40833/ransomware-statistics-for-2021-year-in-summary/" Pattern match: "https://blog.emsisoft.com/wp-content/uploads/2020/05/Report_-Ransomware-statistics-for-Q1-2020-568x319.png" Pattern match: "https://blog.emsisoft.com/en/40813/the-state-of-ransomware-in-the-us-report-and-statistics-2021/" Pattern match: "https://blog.emsisoft.com/wp-content/uploads/2021/01/The-State-of-Ransomware-in-the-US_-Report-and-Statistics-2020-568x319.png" Pattern match: "https://blog.emsisoft.com/en/category/protection-guides/spotlight-ransomware/" Pattern match: "https://blog.emsisoft.com/en/40786/ransomware-statistics-for-2021-q4-report/" Pattern match: "https://blog.emsisoft.com/post-ajax.php?token=d9ce4e454b" Pattern match: "https://www.emsisoft.com/en/company/privacy/" Pattern match: "https://www.emsisoft.com/en/business/cloudconsole/" Pattern match: "https://www.emsisoft.com/en/partner/affiliates/" Pattern match: "https://my.emsisoft.com/" Pattern match: "https://help.emsisoft.com/en/#start-livechat" Pattern match: "https://www.emsisoft.com/en/company/jobs/" Pattern match: "https://www.emsisoft.com/en/press/" Pattern match: "https://www.emsisoft.com/en/company/impressum/" Pattern match: "https://www.emsisoft.com/en/company/terms/" Pattern match: "https://www.emsisoft.com/en/company/bugbounty/" Pattern match: "https://status.emsisoft.com/" Pattern match: "https://blog.emsisoft.com/de/" Pattern match: "https://blog.emsisoft.com/fr/" Pattern match: "https://blog.emsisoft.com/it/" Pattern match: "https://blog.emsisoft.com/ru/" Pattern match: "https://twitter.com/emsisoft" Pattern match: "https://www.linkedin.com/company/emsisoft" Pattern match: "https://www.emsisoft.tv" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-youtube" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a#icon-rss" Pattern match: "https://blog.emsisoft.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22" Pattern match: "https://blog.emsisoft.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/js/app.js?id=34292d903231df08668a&ver=9d69894f99eda12131299229af3d831e" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/js/jquery.fancybox.min.js?id=b92d47642e3247c8999d&ver=3.2.10" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_base/dist/js/blog.js?id=7ceb48526cba8a3fecad&ver=9d69894f99eda12131299229af3d831e" Pattern match: "https://blog.emsisoft.com/wp-content/themes/emsisoft_blog/dist/js/app.js?id=a9c776050212398fe078&ver=9d69894f99eda12131299229af3d831e" Pattern match: "https://blog.emsisoft.com/wp-includes/js/wp-embed.min.js?ver=9d69894f99eda12131299229af3d831e" Pattern match: "https://blog.emsisoft.com/wp-content/plugins/wp-socializer/public/js/wp-socializer.min.js?ver=7.1" Pattern match: "https://fonts.gstatic.com" Pattern match: "https://fonts.googleapis.com/css2?family=Cabin:wght@400;600;700&display=swap" Pattern match: "https://ws.zoominfo.com/pixel/611d24fa766fa2001c8438f7" Pattern match: "https://intel471.com/dist/assets/app.f6075bd9.js" Pattern match: "https://intel471.com/dist/assets/vendor.aaab0acf.js" Pattern match: "https://intel471.com/dist/assets/app.230b7ce9.css" Pattern match: "https://d39ec1uo9ktrut.cloudfront.net/_1200x630_crop_center-center_82_none/AdobeStock_319464701-min.jpeg?mtime=1622000140" Pattern match: "https://intel471.com" Pattern match: "https://intel471.com/humans.txt" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-KBP9RXG" Pattern match: "https://intel471.com/cache/imager/assets/1933/Intel471-Logo-white_bffa016ebaa7817710e036f02d34bdf0.webp" Pattern match: "https://intel471.com/cache/imager/assets/1933/Intel471-Logo-white_bffa016ebaa7817710e036f02d34bdf0.png" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://intel471.com/titan" Pattern match: "https://intel471.com/products" Pattern match: "https://intel471.com/products/adversary-intelligence" Pattern match: "https://intel471.com/products/credential-intelligence" Pattern match: "https://intel471.com/products/malware-intelligence" Pattern match: "https://intel471.com/products/vulnerability-intelligence" Pattern match: "https://intel471.com/solutions" Pattern match: "https://intel471.com/solutions/brand-protection" Pattern match: "https://intel471.com/solutions/fraud" Pattern match: "https://intel471.com/solutions/insider-threat" Pattern match: "https://intel471.com/solutions/security-operations" Pattern match: "https://intel471.com/solutions/threat-hunting" Pattern match: "https://intel471.com/solutions/third-party-risk" Pattern match: "https://intel471.com/partners" Pattern match: "https://intel471.com/partners/integration" Pattern match: "https://intel471.com/partners/channel-partners" Pattern match: "https://intel471.com/partners/alliance" Pattern match: "https://intel471.com/blog" Pattern match: "https://intel471.com/resources" Pattern match: "https://intel471.com/resources/datasheets" Pattern match: "https://intel471.com/resources/cu-girh-download-request" Pattern match: "https://intel471.com/resources/periscope" Pattern match: "https://intel471.com/resources/whitepapers" Pattern match: "https://intel471.com/resources/webinars" Pattern match: "https://intel471.com/glossary" Pattern match: "https://intel471.com/company" Pattern match: "https://intel471.com/company/leadership" Pattern match: "https://intel471.com/company/careers" Pattern match: "https://intel471.com/company/contact" Pattern match: "https://intel471.com/company/events" Pattern match: "https://intel471.com/company/news" Pattern match: "https://intel471.com/search" Pattern match: "https://intel471.com/cache/imager/assets/2656/AdobeStock_319464701-min_4afcec3877c3cdec30eddc0f6267cb7c.webp" Pattern match: "https://d39ec1uo9ktrut.cloudfront.net/screenshot.png" Pattern match: "https://www.reuters.com/technology/irish-health-service-hit-by-ransomware-attack-vaccine-rollout-unaffected-2021-05-14/" Pattern match: "https://intel471.com/blog/revil-ransomware-arrests-cybercrime-underground" Pattern match: "https://intel471.com/cache/imager/assets/22139/AdobeStock_366568015-min_2e8100a3e85f93e15e30d202bb924e86.webp" Pattern match: "https://intel471.com/cache/imager/assets/22139/AdobeStock_366568015-min_2e8100a3e85f93e15e30d202bb924e86.jpeg" Pattern match: "https://intel471.com/blog/ransomware-attacks-2021-lockbit-hive-conti-clop-revil-blackmatter" Pattern match: "https://intel471.com/cache/imager/assets/20626/AdobeStock_203669171-min_2e8100a3e85f93e15e30d202bb924e86.webp" Pattern match: "https://intel471.com/cache/imager/assets/20626/AdobeStock_203669171-min_2e8100a3e85f93e15e30d202bb924e86.jpeg" Pattern match: "https://intel471.com/blog/groove-gang-ransomware-babuk-revil-blackmatter" Pattern match: "https://intel471.com/cache/imager/assets/13652/AdobeStock_438546527-Cropped_2021-09-08-210912_seuv_2e8100a3e85f93e15e30d202bb924e86.webp" Pattern match: "https://intel471.com/cache/imager/assets/13652/AdobeStock_438546527-Cropped_2021-09-08-210912_seuv_2e8100a3e85f93e15e30d202bb924e86.jpg" Pattern match: "https://intel471.com/blog/information-stealer-ransomware-account-takeover" Pattern match: "https://intel471.com/cache/imager/assets/11836/AdobeStock_334545542_2021-08-16-192717_nsln_2e8100a3e85f93e15e30d202bb924e86.webp" Pattern match: "https://intel471.com/cache/imager/assets/11836/AdobeStock_334545542_2021-08-16-192717_nsln_2e8100a3e85f93e15e30d202bb924e86.jpeg" Pattern match: "https://www.linkedin.com/company/intel-471/" Pattern match: "https://twitter.com/Intel471Inc" Pattern match: "https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg" Pattern match: "https://www.facebook.com/Intel471Inc/" Pattern match: "https://intel471.com/resources/research" Pattern match: "https://intel471.com/company/sales-contact-us" Pattern match: "js.hs-scripts.com/8813571.js" Pattern match: "https://lltrck.com/scripts/lt-v3.js?llid=30823" Pattern match: "http://schema.org,@graph:[{@type:WebSite,author:{@id:#identity},copyrightHolder:{@id:#identity},copyrightYear:2021,creator:{@id:#creator},dateModified:2021-12-25T22:17:04-05:00,datePublished:2021-05-14T10:21:00-04:00,d" Pattern match: "https://abs.twimg.com/responsive-web/client-web-legacy/polyfills.b9199025.js" Pattern match: "https://abs.twimg.com/errors/logo46x38.png" Pattern match: "https://help.twitter.com/using-twitter/twitter-supported-browsers" Pattern match: "https://twitter.com/tos" Pattern match: "https://twitter.com/privacy" Pattern match: "https://support.twitter.com/articles/20170514" Pattern match: "https://legal.twitter.com/imprint" Pattern match: "https://business.twitter.com/en/help/troubleshooting/how-twitter-ads-work.html?ref=web-twc-ao-gbl-adsinfo&utm_source=twc&utm_medium=web&utm_campaign=ao&utm_content=adsinfo" Pattern match: "https://help.twitter.com/en/using-twitter/twitter-blue-labs#nft},responsive_web_notifications_empty_state_redesign_variant:{value:control},responsive_web_ntab_verified_mentions_vit_internal_dogfood:{value:false},responsive_web_oauth2_consent_fl" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900italic-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100italic-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/favicon/apple-touch-icon.png" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/favicon/favicon-32x32.png" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/favicon/favicon-16x16.png" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/favicon/site.webmanifest" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/favicon/safari-pinned-tab.svg" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/favicon/favicon.ico" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/favicon/browserconfig.xml" Pattern match: "https://threatpost.com/" Pattern match: "https://tagan.adlightning.com/math-aids-threatpost/op.js" Pattern match: "www.googletagservices.com/tag/js/gpt.js" Pattern match: "https://qd.admetricspro.com/js/threatpost/ros-layout.js" Pattern match: "https://qd.admetricspro.com/js/threatpost/cmp.js" Pattern match: "https://qd.admetricspro.com/js/threatpost/uspcmp.js" Pattern match: "https://qd.admetricspro.com/js/threatpost/targeting.js" Pattern match: "https://qd.admetricspro.com/js/threatpost/prebid.js" Pattern match: "https://qd.admetricspro.com/js/threatpost/engine.js" Pattern match: "cd.connatix.com/connatix.player.js',c.setAttribute('async','1'),c.setAttribute('type','text/javascript'),n.body.appendChild(c)},n.head.appendChild(t)}}(document)" Pattern match: "https://media.threatpost.com/wp-content/uploads/sites/103/2019/12/30144604/Ransomware_generic.png" Pattern match: "https://schema.org,@type:BreadcrumbList,itemListElement:[{@type:ListItem,position:1,item:{@id:https://threatpost.com/,name:Threatpost}},{@type:ListItem,position:2,item:{@id:https://threatpost.com/category/malware-2/,name" Pattern match: "https://schema.org,@type:NewsArticle,mainEntityOfPage:{@type:WebPage,@id:https://threatpost.com/revil-ransomware-attack-celeb-law-firm/155676/},headline:REvil" Pattern match: "www.google.com" Pattern match: "https://threatpost.com/feed/" Pattern match: "https://threatpost.com/comments/feed/" Pattern match: "assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-cont" Pattern match: "https://threatpost.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp" Pattern match: "assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/publ" Pattern match: "https://threatpost.com/wp-includes/wlwmanifest.xml" Pattern match: "https://threatpost.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fthreatpost.com%2Frevil-ransomware-attack-celeb-law-firm%2F155676%2F" Pattern match: "https://threatpost.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fthreatpost.com%2Frevil-ransomware-attack-celeb-law-firm%2F155676%2F&format=xml" Pattern match: "https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=636531127&back=https%3A%2F%2Fthreatpost.com%2Frevil-ransomware-attack-celeb-law-firm%2F155676%2F" Pattern match: "https://threatpost.com/wp-admin/admin-ajax.php" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-PM29HLF" Pattern match: "http://www.w3.org/1999/xlink" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/photo-newsletter.jpg" Pattern match: "https://threatpost.com/web-privacy-policy/" Pattern match: "https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/loader.svg" Pattern match: "https://threatpost.com/microsite/threatpost-podcasts-going-beyond-the-headlines/" Pattern match: "https://threatpost.com/category/malware-2/" Pattern match: "https://threatpost.com/category/vulnerabilities/" Pattern match: "https://threatpost.com/microsite/infosec-insiders-community/" Pattern match: "https://threatpost.com/category/webinars/" Pattern match: "https://www.facebook.com/Threatpost/" Pattern match: "https://threatpost.com/microsoft-111-bugs-may-patch-tuesday/155669/" Pattern match: "https://threatpost.com/feds-publish-malware-analysis-of-hidden-cobra/155686/" Pattern match: "https://threatpost.com/author/lindseyodonnell/" Pattern match: "https://threatpost.com/gandcrab-operators-resurface-revile-malware/148631/" Pattern match: "https://threatpost.com/newsletter-sign/" Pattern match: "https://variety.com/2020/digital/news/law-firm-hacked-clients-lady-gaga-bruce-springsteen-1234603831/" Pattern match: "https://slack-redir.net/link?url=https%3A%2F%2Fvariety.com%2F2020%2Fdigital%2Fnews%2Flaw-firm-hacked-clients-lady-gaga-bruce-springsteen-1234603831%2F" Pattern match: "https://threatpost.com/double-extortion-ransomware-attacks-spike/154818/" Pattern match: "https://medium.com/@cyble/sodinokibi-ransomware-operators-targets-non-profit-organization-national-eating-disorders-82c46e4db611" Pattern match: "https://register.gotowebinar.com/register/5064791868226032141?source=ART" Pattern match: "https://threatpost.com/category/hacks/" Pattern match: "https://threatpost.com/solarwinds-hack-linked-turla-apt/162918/" Pattern match: "https://media.threatpost.com/wp-content/uploads/sites/103/2021/01/11123653/Solarwind2-540x270.jpg" Pattern match: "https://threatpost.com/2021-solarwinds-fallout-shifting-ciso-budgets/162897/" Pattern match: "https://media.threatpost.com/wp-content/uploads/sites/103/2021/01/08132547/2021-podcast-540x270.jpg" Pattern match: "https://threatpost.com/ryuk-150m-ransom-payments/162905/" Pattern match: "https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/14114608/ransomware-540x270.jpg" Pattern match: "https://threatpost.com/tips-activate-cyber-defense/177955/" Pattern match: "https://threatpost.com/cybercriminals-supply-chain-protect-inbox/178002/" Pattern match: "https://threatpost.com/internet-most-tempting-targets/177869/" Pattern match: "https://threatpost.com/log4j-vulnerability-pressures-security-world/177721/" Pattern match: "https://threatpost.com/log4j-vulnerability-pressures-security-world/177721/#comments" Pattern match: "https://threatpost.com/mobile-phishing-zero-trust-security/177594/" Pattern match: "http://twitter.com/search?q=%23Lazarus" Pattern match: "https://twitter.com/threatpost" Pattern match: "https://threatpost.com/about-threatpost/" Pattern match: "https://threatpost.com/contact-us/" Pattern match: "https://media.threatpost.com/wp-content/uploads/sites/103/2021/12/09015533/ThreatpostMK_TEMPLATE.pdf" Pattern match: "https://threatpost.com/rss-feeds/" Pattern match: "https://threatpost.com/privacy-policy/" Pattern match: "https://threatpost.com/tos/" Pattern match: "https://threatpost.com/advertise/" Pattern match: "https://threatpost.com/category/bh/" Pattern match: "https://threatpost.com/category/breaking-news/" Pattern match: "https://threatpost.com/category/cloud-security/" Pattern match: "https://threatpost.com/category/critical-infrastructure/" Pattern match: "https://threatpost.com/category/cryptography/" Pattern match: "https://threatpost.com/category/facebook/" Pattern match: "https://threatpost.com/category/government/" Pattern match: "https://threatpost.com/category/iot/" Pattern match: "https://threatpost.com/category/mobile-security/" Pattern match: "https://threatpost.com/category/podcasts/" Pattern match: "https://threatpost.com/category/privacy/" Pattern match: "https://threatpost.com/category/rsac/" Pattern match: "https://threatpost.com/category/sas/" Pattern match: "https://threatpost.com/category/videos/" Pattern match: "https://threatpost.com/category/web-security/" Pattern match: "https://threatpost.com/author/sealstara/" Pattern match: "https://kasperskycontenthub.com/threatpost-global/wp-content/plugins/kaspersky-embeds/js/scripts.js?ver=1.0" Pattern match: "https://www.google.com/recaptcha/api.js?render=explicit&ver=202124050927" Pattern match: "assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=bdefecf3" Pattern match: "https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15" Pattern match: "assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=bdefecf3" Pattern match: "assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=bdefecf3" Pattern match: "assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-gravity-forms-dynamic-recaptcha/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-includes/js/wp-embed.min.js&ver=bdefecf3" Pattern match: "http://club.orbisius.com/products/wordpress-plugins/whitelist-ip-for-limit-login-attempts/" Pattern match: "http://analyst1.com/blog/" Pattern match: "http://analyst1.com/file-assets/_1200x630_crop_center-center_none/Analyst1.png/" Pattern match: "http://analyst1.com/file-assets/_1200x675_crop_center-center_none/Analyst1.png/" Pattern match: "https://fonts.googleapis.com/css2?family=Spartan:wght@300;400;600;700&display=swap" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-5X55QVN" Pattern match: "http://analyst1.com/" Pattern match: "http://analyst1.com/platform/features" Pattern match: "http://analyst1.com/platform/personas" Pattern match: "http://analyst1.com/resources" Pattern match: "http://analyst1.com/partners" Pattern match: "http://analyst1.com/company/leadership" Pattern match: "http://analyst1.com/company/blog" Pattern match: "http://analyst1.com/company/news" Pattern match: "http://analyst1.com/company/press-releases" Pattern match: "http://analyst1.com/company/events" Pattern match: "http://analyst1.com/company/careers" Pattern match: "http://analyst1.com/company/contact" Pattern match: "http://analyst1.com/connect/request-demo" Pattern match: "http://analyst1.com/file-assets/rise-rebrand-ransomware-cisa.jpg" Pattern match: "http://analyst1.com/blog/the-rise-and-rebranding-of-ransomware-in-2021" Pattern match: "http://analyst1.com/blog/dark-web-justice-league" Pattern match: "http://analyst1.com/blog/be-the-1-to-put-skin-in-the-game-2" Pattern match: "http://analyst1.com/blog/be-the-1-to-put-skin-in-the-game" Pattern match: "http://analyst1.com/blog/new-ransomware-turns-to-disruption-and-sabotage" Pattern match: "http://analyst1.com/blog/lies-from-the-darkside-ransomware-gang-lied-about-pipeline-attack" Pattern match: "http://analyst1.com/blog/ransomware-gangs-move-toward-efficient-self-automated-attacks" Pattern match: "http://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel" Pattern match: "http://analyst1.com/blog/what-is-the-next-cybersecurity-fable" Pattern match: "https://cdn2.hubspot.net/hubfs/4326998/NK_StateofDisinformation.pdf" Pattern match: "http://analyst1.com/blog/disinformation-campaigns-the-new-cyber-attack-and-weapon-of-mass-distraction" Pattern match: "js.hsforms.net/forms/v2.js" Pattern match: "https://www.linkedin.com/company/analyst1/" Pattern match: "https://twitter.com/UseAnalyst1" Pattern match: "https://www.facebook.com/UseAnalyst1/" Pattern match: "https://www.youtube.com/channel/UCJycN_hr2EsiAOHdutM9NQg" Pattern match: "https://app.termly.io/embed.min.js"2e:T1208,"https://twitter.com/useanalyst1" (Indicator: "twitter") "https://www.youtube.com/watch?v=ZyQCQ1VZp8s&feature=youtu.be" (Indicator: "youtube") "endstream endobj 207 0 obj <> endobj 208 0 obj <> endobj 209 0 obj <> endobj 210 0 obj </LastModified/NumberOfPageItemsInPage 1/NumberofPages 1/OriginalDocumentID" (Indicator: "facebook.com") "" (Indicator: "twitter") "" (Indicator: "twitter") "" (Indicator: "twitter") "" (Indicator: "twitter") "" (Indicator: "twitter") "" (Indicator: "twitter") "" (Indicator: "twitter") "

However, it wasnt all smooth sailing. One of the biggest challenges we faced during the operation related to social media, and Twitter in particular. During one of the more high profile BlackMatter incidents in September 2021, the ransom note was leaked. Ransom notes, including BlackMatter’s, contain critical information intended for the victim only, including instructions on how to reach out and communicate with the threat actor. Consequently, anybody who has access to a note can interact with the gang as though they were the victim.

" (Indicator: "twitter") "

The broad Twitter infosec community quickly picked up on the leak, got their hands on the private link intended for the victim only, and started to hijack the negotiations being held on the BlackMatter communication platform. Soon, both the victim and the BlackMatter operators were confronted with an onslaught of insults and trolling behavior. In addition, screenshots of the conversations were taken and circulated within the Twitter community, which caused even more people to join the “fun”, quickly derailing any sort of intelligence gathering by law enforcement and security researchers in the process.

" (Indicator: "twitter") "