BlackLock Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.
ransomware 121 leak-site claims, all timeLatest observed leak-site post 2026-09-26
aka el-dorado, el dorado
Names and spellings merged by the site editor: blacklocks, el-dorado.
PDF export is unavailable. The threat brief remains available below; use your browser's Print command.
PDF export is unavailable. The threat brief remains available below; use your browser's Print command.
Executive facts
Actor BlackLock
Kind ransomware
Aliases el-dorado, el dorado
Actor record created 2025-07-02
Latest observed 2026-09-26
Leak-site claims 121
Catalogued techniques 0 Scope
Tracked sectors Construction & Engineering, Business & Professional Services, Manufacturing, Automotive, Government
Claim records 2024-06-06 to 2026-09-26 Vulnerability events linked to this group No dated vulnerability events are attached to this group's linked vulnerabilities.
Verified techniques No verified ATT&CK mapping for this group.
Defensive actions No defensive actions are attached to this profile.
Most-claimed sectors Construction & Engineering Business & Professional Services Manufacturing Automotive Government
Activity window in this site's data
This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.
Claim records First observed 2024-06-06 Latest observed 2026-09-26 Claims posted under this group's name or leak-site brand 121 Verified ATT&CK phases represented
No verified ATT&CK mapping for this group
Origin and motivation
Origin and motivation not attributed.
Sourced threat-actor profile: MISP Galaxy (Malware Information Sharing Platform)
Also known as El Dorado, BlackLocks, Eldorado, Mamona, GLOBAL GROUP Source: MISP Galaxy , CC0 1.0 Universal or BSD-2-Clause, by an exact match on the name or one of its listed alternate names.
Cited references: https://asec.ahnlab.com/en/90175/ , https://reliaquest.com/blog/threat-spotlight-inside-the-worlds-fastest-rising-ransomware-operator-blacklock/ , https://www.resecurity.com/blog/article/blacklock-ransomware-a-late-holiday-gift-with-intrusion-into-the-threat-actors-infrastructure , https://cofense.com/blog/from-payment-plan-to-ransomware-inside-a-global-group-attack , https://exchange.xforce.ibmcloud.com/report/details/guid:5689a0200c31471e9cf96949cd00c12c , https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service
No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.
Claims posted under this group's name or leak-site brand
121 on this site ARCA UNLIMITED Architects Construction & Engineering 2026-09-26 source ↗ Apollo 21 – Quality Truck, Bus & Trailer Spare Parts South Africa Automotive 2026-09-23 source ↗ 광명산업(주) Manufacturing 2026-09-06 source ↗ oxforduniversal.com Unclassified 2025-07-02 source ↗ nkcustomer.com Unclassified 2025-06-29 source ↗ www.ubu.ac.th Education 2025-06-26 source ↗ oliveracanarias.com Unclassified 2025-06-25 source ↗ www.rhmc.com.au Unclassified 2025-06-05 source ↗ bridgestoneshepparton.com.au Retail 2025-06-04 source ↗ navesinkrehab.com Healthcare 2025-06-03 source ↗ View all on Breaches → Leak-site claim activity
Claims per month, 2024-06 to 2026-09. Peak 38 in 2024-11.
15 0 4 0 27 38 8 7 0 3 0 6 9 1 0 0 0 0 0 0 0 0 0 0 0 0 0 3
2024-06 2026-09
Show monthly counts as a table 0 additional claims without a disclosure date
Ransomware claim data is unverified: RansomLook (CC BY 4.0).