Interview with BlackMatter, a new ransomware group that only targets companies with $100M+ revenue and says it will avoid certain industries like healthcare
Editor's Note: In July, a new ransomware gang started posting advertisements on various cybercrime forums announcing that it was seeking … Tweets: @dcuthbert and @therecord_media Tweets: Daniel Cuthbert / @dcuthbert : “However, the group said some industries were off limits: It would not extort healthcare, critical infrastructure, oil and gas, defense, non-profit, and government organizations.” Clever. Hit private business and worry less about gov putting political pressure on activities. https://twitter.com/... @therecord_media : “There is one life and we take everything from it.” A new ransomware group called BlackMatter says it is learning from the mistakes of predecessors like REvil and LockBit, via @ddd1ms https://therecord.media/...
Context & Ripple Effects
BlackMatter's interview is a positioning exercise: the group says it only extorts companies with $100M+ revenue and is 'learning from the mistakes' of predecessors like Ryuk, which pioneered big-game hunting of resource-rich firms. Daniel Cuthbert's read in the coverage is that the exclusion list — no healthcare, critical infrastructure, oil and gas, defense, non-profits, or government — is designed to hit private business while minimizing political pressure from governments.
The interview's claims aged badly and fast: two months later, NSA, CISA, and FBI reported BlackMatter attacking critical US infrastructure including the food sector, with demands from $80K to $15M; weeks after that, the group announced it was shutting down, citing 'pressure from the authorities'.
First-order effects
- Large private companies with $100M+ revenue become BlackMatter's preferred target pool — the group is explicitly filtering its victims by ability to pay rather than opportunity.
- The advertised exclusion list functions as reputation management for a ransomware-as-a-service brand recruiting affiliates on cybercrime forums, not as an operational guarantee.
Second-order effects
- The breach of its own red lines drew a joint NSA-CISA-FBI advisory, converting BlackMatter from a criminal-market problem into a national-security priority and raising law-enforcement heat on the operation.
- The 'pressure from the authorities' shutdown shows government attention — the very thing the targeting strategy was built to avoid — becoming the group's undoing within months of launch.
Third-order effects
- If the BlackMatter arc holds, self-imposed victim red lines in ransomware are marketing, not policy — regulators and defenders should treat exclusion lists as claims to verify, not trust.
- The launch-to-advisory-to-shutdown cycle suggests ransomware brands are increasingly perishable under coordinated state pressure, pushing operators toward rapid rebranding rather than durable operations.
The trend: Ransomware groups are adopting corporate-style targeting and brand discipline, but state-level law-enforcement pressure is compressing their operational lifespans to months.