Ransomware needs a way in. Stolen credentials are the cheapest one.
ElDorado Ransomware Group
Ransomware group profile
Description
BrLock, also referred to as BlackLock or formerly El Dorado, is a ransomware-as-a-service (RaaS) operation that emerged in March 2024. The group uses custom-built ransomware written in Go, targeting multiple platforms with a focus on double extortion tactics to pressure victims into paying ransoms.
Key insights
- •Utilizes custom Go-based ransomware designed for cross-platform compatibility.
- •Employs double extortion by encrypting data and exfiltrating sensitive information.
- •Gains initial access through 'traffers' who exploit vulnerabilities like Microsoft Entra Connect.
- •Deletes Volume Shadow Copies to inhibit recovery options for victims.
- •Targets a wide range of sectors, including finance, healthcare, and manufacturing.
- •Implements sophisticated obfuscation techniques to evade detection.
- •Maintains a unique data leak site to enhance pressure on victims.
Threat Level & Status Breakdown
For ElDorado · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for ElDorado in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for ElDorado
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1562
T1562
T1021
T1021
T1041
T1041
T1547
T1547
T1021.001
T1021.001
T1136
T1136
Victims(4)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Sutton Public Schools | United States | Claimed | 6 days ago | |
| Sutton, MA | United States | Claimed | 6 days ago | |
| WHO IS NEXT? | France | Claimed | 12 days ago | |
| 광명산업(주) | South Korea | Claimed | 13 days ago |
Affected countries(31)
Countries where this group has been reported to target or leak victims.