BlackMatter’s reach was set by the directory, not the malware

The week

On October 18, 2021, CISA, the FBI and the NSA issued a joint advisory on BlackMatter, a ransomware-as-a-service operation that had appeared in July 2021. Since then it had targeted multiple US critical infrastructure organizations, including two in the food and agriculture sector. The advisory said BlackMatter samples carried embedded, previously compromised credentials. The attackers used LDAP and SMB to discover hosts in Active Directory and then encrypted those hosts and shared drives remotely. A variant could also encrypt virtualization hosts. Recommended mitigations included strong and unique passwords, multifactor authentication, patching, limits on remote access, segmentation, time-based access for privileged accounts and restrictions on scripting tools. In early November, reports indicated the group was shutting down, a pattern that often precedes a rebrand.

Ransomware advisories are usually read for their indicators: hashes, domains, tool names. The BlackMatter advisory was more useful read for its method. The attackers did not need a novel exploit. They arrived holding valid credentials, asked the directory what existed, and used ordinary Windows administration to reach it. That shifts the question a bank, health system or agency should ask. Detecting BlackMatter by name matters less than knowing how far an attacker holding one privileged credential could go. We take that in three parts: how the credential was obtained, how the directory extended its reach, and which controls set the limit.

How the credential was obtained

The advisory said the ransomware binaries carried credentials that had been compromised before deployment. That detail places the decisive failure earlier than the encryption. Someone stole or bought a working account, and the ransomware was the last step of a longer intrusion. The usual sources are familiar: phishing, reuse of passwords leaked in unrelated breaches, exposed remote desktop and VPN services, and infostealer malware on personal or unmanaged devices that also hold work sessions.

Defense at this stage is identity hygiene. Multifactor authentication on remote access and on every administrative account cuts the value of a stolen password. Monitoring for sign-ins from new locations, impossible travel or unusual hours catches part of what remains. The most neglected task is retiring accounts. Service accounts created for a project years ago often hold broad rights, passwords that never change and no named owner. They are ideal for an attacker and rarely watched, so a quarterly review that disables any privileged account without an owner removes credentials worth stealing.

How the directory extended its reach

Once inside, BlackMatter queried Active Directory over LDAP and reached the hosts and shares it found over SMB. These are not attack tools. They are how Windows networks function. Any authenticated user can read much of a typical directory, including the list of servers and file shares. An account with domain-wide administrative rights can act on almost everything it finds.

This is why the directory sets the blast radius. Where a handful of administrative accounts can log on to every server, every workstation and every share, compromising one of them compromises the estate. Where administration is divided into tiers, so the accounts that manage domain controllers never sign in to ordinary servers or desktops, the same compromise reaches far less. The malware is identical in both cases. The outcome is set by design choices made long before.

The same use of the directory also leaves traces. A workstation account that suddenly queries every computer object, or a single host that opens SMB sessions to hundreds of servers in an hour, is behaving unlike any normal user. Directory services and endpoint tools can record both. Few organizations alert on them, partly because legitimate inventory and backup tools generate similar noise. Building a short allow-list of the systems that are supposed to enumerate the directory, and alerting on everything else, turns the attacker’s reconnaissance into an early warning rather than a footnote in the post-incident report.

Virtualization widened the radius. Encrypting one hypervisor takes down every virtual machine it hosts at once, including some that were never joined to the domain. Hypervisor management consoles are often tied to the same directory for convenience. That means a domain administrator credential may reach the platform beneath the servers, and the backup servers, too. Health systems and agencies that consolidated onto a few large clusters gained efficiency and, without separate administration, a bigger single target. Banks, which tend to run more mature privileged access programs, often still leave service accounts and legacy integrations outside them.

Which controls set the limit

The advisory’s mitigations map onto this picture. Time-based access for privileged accounts means an administrative credential stolen on Tuesday may not work on Wednesday. Segmentation decides which hosts can open SMB connections to which, so one compromised machine cannot address every share. Restricting PowerShell and remote execution to the administrators and jump hosts that need them removes the easiest way to push encryption across a network. Backups stored offline or on immutable storage, under credentials that do not exist in the production directory, keep recovery out of reach.

None of these is a product purchase. They are configuration and operating discipline, and they compete with daily work for attention. Tiering also has real costs. Administrators need separate accounts and often separate workstations, and some vendor tools assume domain-wide rights and must be reconfigured or replaced. Organizations that tried to tier everything at once often stalled. Those that started with the domain controllers, hypervisor management and backup systems, the assets whose compromise ends the game, made faster progress.

A useful exercise is to pick the most privileged account in the environment and trace it on paper. List everything it can reach, every system where it has signed in, and every place its credentials could be harvested. That map is the blast radius. Measuring it before and after each control is a better progress metric than counting tools deployed. A second metric is the number of accounts with domain administrator or equivalent rights, which in many organizations runs into dozens when a handful would do.

With hindsight

BlackMatter itself was short-lived, but its method outlasted it. Researchers linked the group to the earlier DarkSide operation and to ALPHV, or BlackCat, which was behind the February 2024 attack on Change Healthcare that disrupted claims and pharmacy processing across the US health system. Encryption of virtualization hosts became a standard feature of major ransomware families. The defenses that proved durable are the ones the advisory pointed toward: tiered administration, phishing-resistant authentication for privileged access, segmentation, and backups that cannot be reached with domain credentials. Attackers also found new ways to get the first credential. By this point in 2026, help desk social engineering to reset privileged accounts is one of the dominant routes into large environments. Once inside, the directory still decides how far they go.