Light

Episode #830 Quiz

The BlackMatter Interview
Date: 2021-08-03 | Length: 2 hrs | Episode page at twit.tv

About this episode

This episode analyzes ransomware specialization: Initial Access Brokers sell RDP, VPN, ConnectWise, TeamViewer, and ESX access, pricing by privilege and victim value. It traces BlackMatter as a DarkSide rebrand via identical Salsa20/RSA crypto, discusses self-imposed sector exclusions, and warns enterprises must disable vulnerable Windows legacy features, not merely patch.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the KELA research summarized in the episode, which access type was described as the most common among initial access broker offerings?

Question 1

According to the KELA research summarized in the episode, which access type was described as the most common among initial access broker offerings?

SSH and VNC-based access Citrix and Fortinet-based access SMTP and webmail-based access RDP and VPN-based access

Question 2: What did KELA report as the average and median price, respectively, for network access listings over the year they studied?

Question 2

What did KELA report as the average and median price, respectively, for network access listings over the year they studied?

$5,400 average and $12,000 median $1,000 average and $5,400 median $5,400 average and $1,000 median $12,000 average and $500 median

Question 3: What specific cryptographic evidence did Fabian Wosar cite to support the claim that BlackMatter was a DarkSide rebrand?

Question 3

What specific cryptographic evidence did Fabian Wosar cite to support the claim that BlackMatter was a DarkSide rebrand?

Its MD5 and RC4 routines were exact copies Its RSA and Salsa20 routines were exact copies Its ChaCha20 and Poly1305 routines were exact copies Its AES and SHA-256 routines were exact copies

Question 4: In the BlackMatter interview, what did the group say about how much of a file it encrypts, and how did that compare to LockBit?

Question 4

In the BlackMatter interview, what did the group say about how much of a file it encrypts, and how did that compare to LockBit?

BlackMatter encrypts 4 MB, while LockBit encrypts 1 MB BlackMatter encrypts 1 MB, while LockBit encrypts 256 KB BlackMatter encrypts 256 KB, while LockBit encrypts 1 MB BlackMatter encrypts the entire file, while LockBit encrypts only metadata

Question 5: What rationale did BlackMatter give for avoiding certain targets such as critical infrastructure?

Question 5

What rationale did BlackMatter give for avoiding certain targets such as critical infrastructure?

It was required to do so by the Recorded Future interview process It believed such targets would never pay ransom demands It wanted to avoid unwanted attention from offensive cyber operations It lacked the tooling to encrypt those environments reliably

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.