The BlackMatter ransomware group has announced that they will be ceasing all operations immediately, due to significant police pressure from numerous organizations. Threat actors uploaded a post to their ransomware portal, stating “Due to certain unsolvable circumstances associated with pressure from the authorities … the project is closed. After 48 hours, the entire infrastructure will be turned off.” However, there have also been some developments surrounding the group as a whole over the past two weeks. The first being that analysts from Microsoft and Gemini Advisory linked the FIN7 threat group to a public security firm, Bastion Secure. FIN7 are considered the creators of the BlackMatter and Darkside families. In addition, BlackMatter’s ransomware strain had been successfully reverse engineered and companies were offering a secret decryption tool to victims, cutting profits for the group. Lastly, growing news surrounding the United States and Russia stating that both superpowers are in collaboration to crack down on Russian-based threat groups, which is where FIN7 is believed to reside. While the group states that they will be shutting down, CTAPT believes that affiliates of the group will most likely either rebrand once again or join other threat groups. CTAPT analysts are monitoring the fallout of BlackMatter and will provide additional updates as needed.