Black X is a ransomware operator currently active on public leak sites. Darkfield has indexed 4 public victims claimed by this operator between June 2, 2026. Black X is a nascent ransomware group first observed in June 2026 with limited public documentation available from major threat intelligence sources including CISA, FBI, Mandiant, or comparable research organizations. With only four known victims on record, the group remains in early operational stages, though its targeting pattern suggests a financially motivated threat actor pursuing opportunistic or selectively targeted intrusions across geographically diverse regions. The group has demonstrated activity spanning South Africa, the Philippines, South Korea, and Germany, indicating either a broad global targeting posture or the use of affiliate infrastructure capable of operating across multiple jurisdictions. Targeted sectors include Business Services, Healthcare, Energy, and the Public Sector, a mix consistent with groups seeking high-value data for double extortion leverage or organizations with lower tolerance for operational disruption and therefore greater likelihood of ransom payment. Due to the group's limited operational history and the absence of formal attribution or technical reporting from authoritative cybersecurity bodies, specific details regarding initial access vectors, tooling, encryption methodology, and affiliation structures cannot be responsibly stated at this time. Black X should be considered an emerging and closely monitored threat, and organizations operating in the identified target sectors and regions are advised to maintain heightened defensive posture pending further intelligence development.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.