ElDorado
In September The El Dorado ransomware group have been rebrand as BlackLock
source: ransomware.live1 refs →
ElDorado
ElDorado, now known as BlackLock, is a financially motivated ransomware group targeting critical sectors.
Analyst brief
ElDorado, now rebranded as BlackLock, is a financially motivated ransomware group engaged in cybercrime. The group primarily targets critical infrastructure, financial, and manufacturing sectors. Their key TTPs include double extortion data theft, exploitation of vulnerabilities, and custom ransomware tools to encrypt Windows systems. Defenders should ensure that legacy ElDorado IOCs are mapped to the new BlackLock infrastructure due to the rebranding and strengthen network segmentation against lateral movement signs.
crime
FAQ2
Under what new name is the ElDorado ransomware group operating?
The ElDorado ransomware group is now rebranded as BlackLock.
What is the primary extortion tactic used by the ElDorado/BlackLock group?
Their key TTPs include double extortion data theft.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.