In an instance of “hacking the hackers,” threat hunters have infiltrated the infrastructure of the BlackLock ransomware group, uncovering significant insights into their operations. Researchers identified a security vulnerability in BlackLock’s data leak site (DLS), enabling the extraction of configuration files, credentials, and command histories. The flaw involved a misconfiguration that exposed clearnet IP addresses related to the group’s network behind TOR hidden services, marking a substantial operational security failure. BlackLock, a rebranded version of the Eldorado ransomware group, has become one of the most active extortion syndicates in 2025, targeting sectors such as technology, manufacturing, finance, and retail. As of last month, forty-six (46) victims from diverse countries including Argentina, Brazil, the United States, and others were listed on its site. The group also launched an underground affiliate network in January 2025, recruiting “traffers” to direct victims to malware-deploying pages for initial system access. The vulnerability identified by researchers is a local file inclusion (LFI) bug, which allowed a path traversal attack leading to sensitive information leakage. Notable findings include the use of Rclone to exfiltrate data to the MEGA cloud storage service, and the creation of multiple MEGA accounts using disposable email addresses for storing victim data. Reverse engineering revealed similarities between BlackLock and another ransomware strain, DragonForce, although they differ in code language (BlackLock uses Go while DragonForce uses Visual C++). Intriguingly, BlackLock’s DLS was defaced by DragonForce on March 20, likely exploiting the same LFI vulnerability, with configuration files and internal chats leaked. This followed the defacement of Mamona ransomware’s DLS a day prior. Researchers speculate that BlackLock may have cooperated with DragonForce or transitioned ownership due to market consolidation, potentially compromising previous operations.