Trend Micro researchers have emphasized the similarities between the recently released “LockBit 3.0” ransomware, aka “LockBit Black”, and “BlackMatter” ransomware in their latest report. BlackMatter is a known rebrand variant of the “DarkSide” ransomware that dissipated in November of 2021. Researchers analyzed unpacked samples of LockBit 3.0 and noted that portions of the ransomware’s code appear to be taken from BlackMatter’s source code. LockBit 3.0 and BlackMatter have an identical routine of performing API harvesting, which involves hashing the API names of a dynamically linked library (DLL) and then comparing the hashes to the list of APIs the ransomware requires. The XOR key utilized for renaming APIs is also identical between the two (2) ransomwares. The anti-debugging technique used in BlackMatter and LockBit 3.0 to crash debuggers by adding a breakpoint is identical as well. Both ransomwares employ threading rather than directly calling an API in order to make analysis more difficult. Researchers also noted that LockBit 3.0 retains specific BlackMatter routines for privilege escalation and utilizes the same technique as BlackMatter to delete shadow copies. Researchers emphasized that “it would be no surprise if some of BlackMatter’s affiliates had joined the ranks of the LockBit group, considering LockBit’s recent rise in notoriety, which would explain the many similarities between the two pieces of ransomware.” An in-depth analysis of additional similarities as well as indicators of compromise can be viewed in Trend Micro’s report linked below.