El Dorado is a Ransomware-as-a-Service (RaaS) operation that first emerged in March 2024, publicly advertising its affiliate program on the RAMP forum. The group, which rebranded to BlackLock around September 2024, is believed to be of Russian origin, with its representatives communicating in Russian. El Dorado's primary motivation is financial gain through double extortion, encrypting victim data and threatening to leak or sell exfiltrated sensitive information if a ransom is not paid. A key characteristic that differentiates El Dorado is its custom-developed ransomware builder, written in Golang, which supports cross-platform targeting of Windows, Linux, and VMware ESXi environments, and does not rely on previously leaked ransomware source codes. The RaaS model allows affiliates to customize various attack parameters, enhancing its operational flexibility.

Aliases del actor

El-DoradoGlobalBlackLockEldoradoEl Dorado DoxwareBlacklock

Actores similares

ElDoradoransomware · 2blacklockransomware · 3fletchenransomware · 2globalactor · 2TA582apt · 0TA2726apt · 0TA2723apt · 0GOLD REBELLIONapt · 0TA583apt · 0HolyWaterapt · 0