Thread by @chainalysis

THREAD: Based on our blockchain analysis, we can confirm reports speculating that DarkSide #ransomware group has rebranded to BlackMatter. This is part of a trend in which ransomware groups shut down & reemerge with new names, often after law enforcement actions or media scrutiny

Chainalysis was able to confirm the financial connection between DarkSide and BlackMatter in late July '21 a few days before security researchers speculated there was a connection based on similarities w/ their encryption algorithms, decryptors, and more: bleepingcomputer.com/news/security/…

Sometimes following the money can provide an early indicator about a ransomware group’s revitalized operations. In this case, financial connections were made on the blockchain before any attacks were made public on BlackMatter’s blog
therecord.media/an-interview-w…

There is no silver bullet in solving the ransomware challenge. But this demonstrates that blockchain analysis is an important tool in the investigative toolkit, and can help investigators identify actors across the ransomware supply chain as the landscape evolves and matures.

For more analysis of ransomware activity this year, read our report, now with updated data through mid-July: go.chainalysis.com/ransomware-202…