http://ransomlookumjrc6erzqn467lkcu2t5h4enjzfigvsxrrktxicysi2yd.onion/group/blackmatter
The group focused on large organizations in industries such as critical infrastructure, agriculture, technology, and manufacturing, but claimed to avoid hospitals, nonprofits, and government entities (though some reports contradict this). Initial access methods included exploitation of known vulnerabilities, stolen credentials from brokers, and phishing campaigns.