Blacktor is a financially motivated data breach and extortion group active in 2021.
Blacktor is a low-profile, financially motivated data breach and extortion group active around 2021. The group targets victims in Indonesia, Italy, Venezuela, and the US, using a Tor-based leak site to publicly threaten and expose stolen information. Their primary TTPs involve data theft followed by extortion threats of public shaming, though specific tools and exploits used remain undisclosed in open threat intelligence. Defenders, especially those in the mentioned geographies, should focus on network defense, implement strict Data Loss Prevention (DLP) measures, and monitor for abnormal data exfiltration patterns.
Blacktor is a low-profile data breach and extortion group active around 2021 with a Tor-based leak site, claiming victims in Indonesia, Italy, Venezuela, and the US, with minimal public threat-intelligence coverage.
The Blacktor group has claimed victims in Indonesia, Italy, Venezuela, and the US.
The primary TTPs used by Blacktor involve data theft followed by extortion threats of public shaming.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.