blackmatter

BlackMatter was a ransomware-as-a-service operation active from July to November 2021, widely assessed as a direct rebrand combining elements of DarkSide and REvil, operated by Russian-speaking cybercriminals following DarkSide's shutdown after the Colonial Pipeline attack triggered intense US government pressure. The group targeted large enterprises including NEW Cooperative (US agricultural) and Olympus, demanding multi-million dollar ransoms. BlackMatter shut down in November 2021 citing "pressure from local authorities"; its operators and infrastructure were subsequently absorbed into the ALPHV/BlackCat operation, completing the DarkSide → BlackMatter → ALPHV rebrand chain.