BlackLocks is a ransomware operator currently active on public leak sites. Darkfield has indexed 1 public victims claimed by this operator between September 5, 2026. BlackLocks is a ransomware group first observed in September 2026 with an apparent financial motivation, though limited public documentation exists given the group's recent emergence and low victim count. Based on available data, the group has claimed at least one known victim, with targeting activity concentrated in South Korea and focused on the manufacturing sector, suggesting a deliberate or opportunistic interest in industrial and production-oriented organizations. No authoritative public reporting from CISA, FBI, Mandiant, or equivalent reputable security research organizations has been indexed regarding this group's specific initial access vectors, tooling, encryption methods, or extortion tactics at this time, which is consistent with a newly identified or low-volume threat actor that has not yet attracted significant public analytical attention. The group's single documented victim and narrow geographic and sectoral footprint may indicate early-stage operations, limited operational capacity, or selective targeting. No notable high-profile campaigns, record ransom demands, or law enforcement actions against BlackLocks have been publicly documented. BlackLocks should be considered an emerging threat actor of uncertain capability and affiliation, warranting continued monitoring as additional victims or technical indicators may surface through subsequent reporting.

Recent disclosures by BlackLocks

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• 광명산업(주)Manufacturing · KR · September 5, 2026

See every disclosure indexed for BlackLocks →