Blackwater
| Active
Blackwater is a ransomware group that first surfaced in early 2026, combining file encryption with data theft and targeting healthcare organizations, with known victims including Minidoka Memorial Hospital in Idaho.
Victims
11
First Victim
2026-03-20
(est. attack date)
Discovery Date
2026-05-02
Last Seen
2026-08-15
Inactive Since
1
day
Avg Delay
15.6
days
Infostealer
70.0%
victims with domain
Countries
6
hit
Uptime
96.3% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
Stable vs last month
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Blog | Yes | 2026-08-16T05:16:19 | nginx |
ejzl7cjxmkx7lzhiqwidmrwtfjv45pkczbc4fnyaut3t7gll3yaiq5id.onion
|
Target
Top 5 Activity Sectors
- Professional Services 2
- Healthcare 2
- Manufacturing 2
- Energy & Utilities 1
- Hospitality 1
Top 5 Countries
-
China
3
-
Brazil
2
-
United States
2
-
Argentina
1
-
India
1
Heatmap
Ransom Notes (1)
YARA Rules (1)
Victims (11)
customers' personal data, contract information, internal company data:
http://[REDACTED].onion/s/7f…
Shenzhen Gongjin Electronics, founded in 1998 and also known as T&W, is a telecommunications manufac…
Compass Housing Alliance is dedicated to developing and providing essential services, shelter, and a…
Founded in 1983 and headquartered in Ningbo, China, Ningbo Tuopu Group Co., Ltd. is a multipurpose e…