blackout Ransomware Group
Ransomware group profile
3Victims
RussiaSource country
85Impact score
Also Known As
Blackoutware
Description
Blackout is a sophisticated ransomware group that targets critical infrastructure and large enterprises. They utilize advanced infiltration techniques to deploy ransomware and employ double extortion tactics, resulting in significant operational disruptions for their victims.
Key insights
- •Targets critical infrastructure, particularly in the healthcare sector.
- •Employs double extortion tactics by encrypting data and threatening to release stolen information.
- •Uses custom malware and sophisticated phishing schemes for initial access.
- •Has been observed leveraging zero-day vulnerabilities and collaborating with other cybercriminal groups.
- •Ransom demands typically range in the millions of dollars.
Threat Level & Status Breakdown
For blackout · Based on incidents in selected period
0.6threat level
Aggressiveness1.8/ 10
Lethality0/ 10
Criticality0/ 10
Status Breakdown
Claimed100.0%3
First seenFeb 2026
Last seenJul 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedJul 23, 2026
Recent activity
Monthly attack count for blackout in the selected period
3Total attacks
2peak in Jul
1.5avg / month
↑ 1 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for blackout
- 3e9d22280a28ec73b6e84550febb8425d9c660f9777e2e4d3b5baaedea263cbe
- 1b5a73cafa33d82e994e8928279a3b97b0c424422bf678284ee9877c00de2c48
- 48046fb0e566f5a2d184f84b76d6cadc458762556daed0ae4a3a1200afbefb54
- c0c726a23111c220d022fcd01a85f9788249e42baece03f83b6059170453b801
- c3dc5c64193f849ca5048d0e81ee1778ffc086087a20de1e09aef68a8bd560b2
- 8cc69beceb9be0239125affffe902401
- 19eb63db7fa79fae746e1f2b4d3bc5c4fbd0e7a7a9e372e7345cddd6cb0020c1
- 759b96f44806578cc0836a3a2bf11c8bc553effac72f8d28b94aec78b66be906
- 5470dd5e57d0060d98891d8f5740e5b2
- 6fe8943f364f6308c2e46910bffefeaf
- 19fd3337b21a78c86880a4eb47657a1cccd08f81e8196b19e508e8820d7ec741
- 91a4e6f6d51daee773a8f00279792578
- 1e20360e439594eeb38782b6dbf8de1de214a0b0f657d6c83c6c7a150498d6f4
- f812bdaecdcec818d015b1a8d1d21c40
- 6969697820511281801712341067111416133321394945138510872296106446
- 507e8666c239397561c58609f7ea569c9c49ddbb900cd260e7e42b02d03cfd87
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
- c0621954bd329b5cabe45e92b31053627c27fa40853beb2cce2734fa677ffd93
- 8edbb1944d94ff91ee917c31590b6d1d5690a52fc153e44355ee9749aa0f4625
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- bdc4fd7329e5f5baa7964b24c61171fd
- e5b2e603861e8e01b7a03122280f2e90
- 8b66d1eda2f1e0a858e0747307552e0b
- b94fab0b5c5854055c28b8ab3ce2d579ec9f66140251be8209729464fa717556
- 4103a09887b82ffd56a93bb431805224
- 1eb19f45b8b228785d6f9e3736de902b07422b1911790e36a3a1a7dd35ae0b06
- 5d5d639fdfbf632bb7d9f1bb28731217d09d36078ab5e594baf2a5a41267a5d2
- 0efeb6b9699b7fbebf5e0657a14c7f88
- 9262a37df166ac1d5f582aac79f54ccb47623bfd9ba001228d284ae13a08f52f
- 364f1b7466d8e4c9f55294ecf1f874c763bcf980c59b0250c613ac366def6aca
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
- ee4575cf9818636781677d63236d3dc65652deab
- 74056c6fe7d5670c41e56c2d00f27880cf47784caffde890ec3f79c0276c99b8
- 01e0960c04097f73dbaaa45025370763ed26f488538c7195203dd3584d145891
- 33a8024395c56fab4564b9baef1645e505e00b0b36bff6fad3aedb666022599a
- eeda5a1a503233f6de3eac3f34cabc2f
- 3e92f697d642d68bb766cc93e3130b36b2da2bab
- 2d85fb64f37e78913c20ee9c886d33be
- 7eb58ca2d1bcc354a1a722fb8025d88289e4ec3ecbf0d7d612b7b2d1ee2e26a3
- 4ccd9e987f918500ddfc538d96b78ab4e6383b838e3e508311fd6ae815bd156f
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- dd0983d7b298743ab90fd6b9eff7c24cffa33c2678d82e971a69eeb3fda0ca98
- 4fbd2f5b4625fa46b5706748dbb15d3f58fbeda723fc644d0db9174a78cbade1
- ed15c8344b45daed1e0578f8bc1a32411812c61f4cb45d89b107287de0e09ffc
- 71612ebcc591b2475d3488e5580db56a
- 5df07f2b3ddae4b24d05926167a4a5968e2748efe744e4600f968be9abd293a2
- 3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
- 9129f200ec9a89896005ee67457f57ff250f8ebef7ca1ccc75a1b8df42fe9b19
- 0e6578dc4f95565c1426e3f188d36460
- 61a6878a3a864df7664b2729e9ae3b5448dcd1c087cbb36b6a7827d83061c127
- 8f2d99c8f48c1e73c69666218fa7b791ed5ff7900ee66cf1ea24a711529971ef
- dd965684ec191206014e72b302492a5c6ccb285ff4afe4f39cf760f6dccfc129
- 76632910cf67697bf5d7285fae38bfcf438ec082
- 523613a7b9dfa398cbd5ebd2dd0f4f38
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- 63eb3d2886d9cb880c9b0d54b94f3e149b3b5b6215a33a0ef63588a09dcd4499
- f3064e852a2dd178aeb950c914f42689bf075ccaddf881938c4f7ff6b418d0f4
- dc4840a0992b218cbedd5a7ac5c711cb98f1f9e78a8ffdea37c694061dfd34c6
- 50479953865b30775056441b10fdcb984126ba4f98af4f64756902a807b453e7
- 40fc5e5c4bc7ac0880dcf1635acd01c09dba0411ef7ac4f4cc0e309412aae348
- 736de79e0a2d08156bae608b2a3e63336829d59d38d61907642149a566ebd270
- 925eea2692c4d8dec9b8f1c94a8c8229
- cb1dc056cfd268fee14ca1945a76e0d8
- d528158a6459a71a33e3c05a606b6b33
- 27835a844314e2f88b92ed2d1e8fdc18
- 32f9c7fb69bb7ee76e19f4bbee16f4b3
- 71eba7b77838fffb0754852a9335555468dd161f87eb5ce048bceeb4d66ba64f
- 3fed834849907bdb3ae5fbd6c7a17e67256edf1d2fde2f1473d8dc4dfccfe6e6
- 0608101047106453101617106423101013101012101083109710108585106969
- c55da8868f575cfcf94c3b23adb879931aba4174a4894bc1d378e77391acdee1
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for blackout
Defense Evasion
T1562
Impair Defenses
Execution
T1059
Command and Scripting Interpreter
T1047
Windows Management Instrumentation
T1140
Deobfuscate/Decode Files or Information
Impact
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
Lateral Movement
T1021
Remote Services
Other
T1550
T1550
T1125
T1125
Persistence
T1078
Valid Accounts
Victims(3)
| Company | Domain | Country | Industry | Status | Discovered | |
|---|---|---|---|---|---|---|
| www.miatech.net | miatech.net | US United States | Hospitality | Claimed | about 1 year ago | |
| bluebellgroup.com | bluebellgroup.com | GB United Kingdom | Retail & E-Commerce | Claimed | 5 days ago | |
| en.yofc.com | — | CN China | Technology | Claimed | 5 months ago |
Affected countries(15)
Countries where this group has been reported to target or leak victims.