Jul 17, 2026, 01:07 AM
-------------- [Welcome to DarkMatter] -------------->
Who are we?
-------------------------
Purpose -> targeting small, medium, and large enterprises. We do not attack low-profit or non-profit organizations. Our focus is maximum impact on organizations that can afford to pay,
We operate professionally, and with strict discipline. Our infrastructure is hardened, our communications are encrypted,
and our affiliate program is welcomming.
We provide full operational support to our affiliates: custom builds, unique extensions per victim, dedicated TOR panels, and real-time callback reporting.
We value long-term partnerships over short-term gains, and we maintain a clean reputation in the underground by honoring our obligations to every affiliate.
For affiliates.
-------------------------
Entry Price:
- CIS affiliates: $250 in either BTC or XMR
- Non-CIS affiliates: $500 in either BTC or XMR
Affiliates:
- Upgradeable profit share depending on your negotiation success and revenue earned
- Supported for Windows, Linux, NAS, ESXi, AWS (S3), GCP, RedHat & MacOS lockers
- Teams access: create your own teams, invite members, assign roles, share victims
- Full-featured affiliate panel with TOR access
Builder:
Generate platform-specific lockers: Windows (EXE, DLL, Reflective DLL, PS1, BAT), Linux (ELF), ESXi, NAS, AWS S3, GCP, RedHat, MacOS
54+ build settings per platform: encryption mode, speed, scope, injection method, evasion, spread, persistence, etc.
Custom encrypted file extension per victim (base64-derived from Machine GUID)
Password-protected builds
One-click build generation with server-side compilation
Build history with download and delete management
Toolkit (standalone tools):
Packer: obfuscation and packing for custom payloads
Killer: standalone process/service termination tool
Exfil: file exfiltration tool for data theft
Erase: disk wiping and evidence destruction
PsExec: remote execution tool for lateral movement
Inject: process injection tool (APC, transacted hollowing, thread hijacking)
Dropper: dropper/stagezero payload generator
Dump: credential dumping tool (LSASS, DPAPI, tokens)
Hook: API hooking and interception tool
Persist: persistence installation tool (registry, scheduled tasks)
Crawl: network reconnaissance and host discovery
Mass Encryption:
Operator-controlled encryption: generate encryptors and decryptors per victim
Server-side key management: encryption keys generated and stored server-side
Per-victim decryptor generation after payment
Build toggle: enable/disable individual victim builds
Victim management: create, delete, track encryption status
Negotiations:
Dedicated TOR-based chat for each victim
Real-time messaging with the victim
Mark payment status (paid/unpaid)
Set and update ransom amount
Set and update payment deadline
Pin important messages
Archive completed negotiations
Attach leak links to negotiations
File download/upload within chat
Negotiation overview dashboard
Stealer:
Stealer session management: view captured sessions from stealer builds
Stealer build configuration: create and manage stealer configs
Config download: export stealer configs for deployment
Session viewer: browse captured cookies, passwords, tokens
Reports & Callbacks:
Real-time callback reporting: locker reports encryption stats back to panel
Encryption report dashboard: view encrypted file count, total size, status per victim
Mark victims as decrypted after payment
Import encryption keys for decryptor generation
File tree generation: view list of encrypted files per victim
Victims:
Full victim CRUD: create, edit, view, delete victims
Victim status tracking: pending, encrypting, encrypted, decrypted
Publish/unpublish victims to the leak site
Per-victim build generation
Victim notes and metadata
Communication:
Direct chat with operators for support
Ticket system for issues and requests
FAQ section
Announcements from operators
Group chat for affiliates
Earnings & Payouts:
Real-time earnings dashboard
Payout history and tracking
Configure payment wallets (BTC, XMR)
Request payouts directly from the panel
Weekly payouts with $1,000 minimum threshold
Security:
PGP-encrypted login challenge
Two-factor authentication support
Backup codes for account recovery
Session management: view active sessions, kill sessions
Account settings: password change, PGP key, locale, theme
Team Management:
Create teams and invite members
Role-based access within teams
Share victims and chats across team members
Team task management
Team-level victim and chat assignment
Rules:
- Strict no attack policy: No attacking any companies/targets in the CIS region, No attacking any form of Healthcare
Who are we looking for?
-------------------------
A limited number of stable and adequate partners, who understand why you need to upload data, what backups are and how to delete them, Russian-speaking, with average payouts of 70k.
Who are we NOT looking for?
-------------------------
- Doubtful personalities, employees of the secret service and analysts of information security companies.
- Those who install Dedicated servers and engage in activities different from the supply of networks
- Any topics and suggestions different from this post.
- Those who want to learn pentesting and earn millions.
- Those who like to bet 100kk ransom for 3.5 servers.
The soft?
-------------------------
Windows:
- Multiprocessing. Up to 20 parallel encryptor threads with dedicated scanner threads. Fastest solution on the market.
- EXE, DLL, Reflective DLL, PS1, BAT and memory-only (fileless) payloads.
- 5 encryption speed modes: Auto / Fast / Full / Medium / Secure.
- 4 encryption scopes: Auto / Local / Network / Backups.
- 54+ build settings in the affiliate panel (services, processes, backup folders, accounts, injection methods, etc.).
- 7 UAC bypass methods: ICMLuaUtil COM, CMSTP COM, FodHelper, ComputerDefaults, EventViewer, SilentCleanup, WSReset.
- Impersonation for working with network resources. Named pipe impersonation + stored credential login (full access to network resources).
- Integration with Active Directory, GPO persistence, after encryption is complete, traversal of the entire domain.
- Drag-n-drop folders, drives, files. Command line parameters. Safe mode reboot with networking.
- Freeing busy files via Restart Manager API. Process whitelist to keep critical processes alive.
- AES-256-CTR / Salsa20 / ChaCha20 / Dual / Triple / PQ-Hybrid encryption pipelines. Polymorphic decryptor.
- VSS shadow copy deletion + encryption. BitLocker drive capture. Free space wiping.
- ETW patching, AMSI bypass, thread hiding from debugger, PEB masquerade.
- Anti-debug, anti-VM (VMware, VirtualBox, Hyper-V, QEMU, sandbox). Language/locale check (excludes Russian systems).
- Credential dumping: LSASS minidump, token impersonation, stored Windows credentials.
- Network spread: SMB share scanning, PsExec deployment, GPO script deployment.
- Defender disable, event log clearing, Task Manager disable, PowerShell history cleanup.
- Hidden mode: self-destruct after encryption, file timestamp preservation, invisible mode.
- Per-machine encrypted file extension (base64-derived from Machine GUID).
- Custom wallpaper with ransom message, encrypted file icon association.
- TOR-based decryption portal with unique victim IDs. API callback reporting.
- Password-protected builds. VM-specific kill (named VMs, snapshots). ESXi host targeting.
- System Characteristic Parallel Thread Detection for best possible optimization for the system to prevent crashes and fastest possible finish.
Contact us!!!
-------------------------
- TOX: FD9FDB7C69D7CC1C0BDB85676E33D5508BB5445D51836D4CF03DF3934C79550CFC671687B5EB
Visit us at:
-------------------------
- TOR URL: http://uulyfnw6cqrpuehjnd6xf5cwfh5uo3tmv...ayd.onion/
Who are we?
-------------------------
Purpose -> targeting small, medium, and large enterprises. We do not attack low-profit or non-profit organizations. Our focus is maximum impact on organizations that can afford to pay,
We operate professionally, and with strict discipline. Our infrastructure is hardened, our communications are encrypted,
and our affiliate program is welcomming.
We provide full operational support to our affiliates: custom builds, unique extensions per victim, dedicated TOR panels, and real-time callback reporting.
We value long-term partnerships over short-term gains, and we maintain a clean reputation in the underground by honoring our obligations to every affiliate.
For affiliates.
-------------------------
Entry Price:
- CIS affiliates: $250 in either BTC or XMR
- Non-CIS affiliates: $500 in either BTC or XMR
Affiliates:
- Upgradeable profit share depending on your negotiation success and revenue earned
- Supported for Windows, Linux, NAS, ESXi, AWS (S3), GCP, RedHat & MacOS lockers
- Teams access: create your own teams, invite members, assign roles, share victims
- Full-featured affiliate panel with TOR access
Builder:
Generate platform-specific lockers: Windows (EXE, DLL, Reflective DLL, PS1, BAT), Linux (ELF), ESXi, NAS, AWS S3, GCP, RedHat, MacOS
54+ build settings per platform: encryption mode, speed, scope, injection method, evasion, spread, persistence, etc.
Custom encrypted file extension per victim (base64-derived from Machine GUID)
Password-protected builds
One-click build generation with server-side compilation
Build history with download and delete management
Toolkit (standalone tools):
Packer: obfuscation and packing for custom payloads
Killer: standalone process/service termination tool
Exfil: file exfiltration tool for data theft
Erase: disk wiping and evidence destruction
PsExec: remote execution tool for lateral movement
Inject: process injection tool (APC, transacted hollowing, thread hijacking)
Dropper: dropper/stagezero payload generator
Dump: credential dumping tool (LSASS, DPAPI, tokens)
Hook: API hooking and interception tool
Persist: persistence installation tool (registry, scheduled tasks)
Crawl: network reconnaissance and host discovery
Mass Encryption:
Operator-controlled encryption: generate encryptors and decryptors per victim
Server-side key management: encryption keys generated and stored server-side
Per-victim decryptor generation after payment
Build toggle: enable/disable individual victim builds
Victim management: create, delete, track encryption status
Negotiations:
Dedicated TOR-based chat for each victim
Real-time messaging with the victim
Mark payment status (paid/unpaid)
Set and update ransom amount
Set and update payment deadline
Pin important messages
Archive completed negotiations
Attach leak links to negotiations
File download/upload within chat
Negotiation overview dashboard
Stealer:
Stealer session management: view captured sessions from stealer builds
Stealer build configuration: create and manage stealer configs
Config download: export stealer configs for deployment
Session viewer: browse captured cookies, passwords, tokens
Reports & Callbacks:
Real-time callback reporting: locker reports encryption stats back to panel
Encryption report dashboard: view encrypted file count, total size, status per victim
Mark victims as decrypted after payment
Import encryption keys for decryptor generation
File tree generation: view list of encrypted files per victim
Victims:
Full victim CRUD: create, edit, view, delete victims
Victim status tracking: pending, encrypting, encrypted, decrypted
Publish/unpublish victims to the leak site
Per-victim build generation
Victim notes and metadata
Communication:
Direct chat with operators for support
Ticket system for issues and requests
FAQ section
Announcements from operators
Group chat for affiliates
Earnings & Payouts:
Real-time earnings dashboard
Payout history and tracking
Configure payment wallets (BTC, XMR)
Request payouts directly from the panel
Weekly payouts with $1,000 minimum threshold
Security:
PGP-encrypted login challenge
Two-factor authentication support
Backup codes for account recovery
Session management: view active sessions, kill sessions
Account settings: password change, PGP key, locale, theme
Team Management:
Create teams and invite members
Role-based access within teams
Share victims and chats across team members
Team task management
Team-level victim and chat assignment
Rules:
- Strict no attack policy: No attacking any companies/targets in the CIS region, No attacking any form of Healthcare
Who are we looking for?
-------------------------
A limited number of stable and adequate partners, who understand why you need to upload data, what backups are and how to delete them, Russian-speaking, with average payouts of 70k.
Who are we NOT looking for?
-------------------------
- Doubtful personalities, employees of the secret service and analysts of information security companies.
- Those who install Dedicated servers and engage in activities different from the supply of networks
- Any topics and suggestions different from this post.
- Those who want to learn pentesting and earn millions.
- Those who like to bet 100kk ransom for 3.5 servers.
The soft?
-------------------------
Windows:
- Multiprocessing. Up to 20 parallel encryptor threads with dedicated scanner threads. Fastest solution on the market.
- EXE, DLL, Reflective DLL, PS1, BAT and memory-only (fileless) payloads.
- 5 encryption speed modes: Auto / Fast / Full / Medium / Secure.
- 4 encryption scopes: Auto / Local / Network / Backups.
- 54+ build settings in the affiliate panel (services, processes, backup folders, accounts, injection methods, etc.).
- 7 UAC bypass methods: ICMLuaUtil COM, CMSTP COM, FodHelper, ComputerDefaults, EventViewer, SilentCleanup, WSReset.
- Impersonation for working with network resources. Named pipe impersonation + stored credential login (full access to network resources).
- Integration with Active Directory, GPO persistence, after encryption is complete, traversal of the entire domain.
- Drag-n-drop folders, drives, files. Command line parameters. Safe mode reboot with networking.
- Freeing busy files via Restart Manager API. Process whitelist to keep critical processes alive.
- AES-256-CTR / Salsa20 / ChaCha20 / Dual / Triple / PQ-Hybrid encryption pipelines. Polymorphic decryptor.
- VSS shadow copy deletion + encryption. BitLocker drive capture. Free space wiping.
- ETW patching, AMSI bypass, thread hiding from debugger, PEB masquerade.
- Anti-debug, anti-VM (VMware, VirtualBox, Hyper-V, QEMU, sandbox). Language/locale check (excludes Russian systems).
- Credential dumping: LSASS minidump, token impersonation, stored Windows credentials.
- Network spread: SMB share scanning, PsExec deployment, GPO script deployment.
- Defender disable, event log clearing, Task Manager disable, PowerShell history cleanup.
- Hidden mode: self-destruct after encryption, file timestamp preservation, invisible mode.
- Per-machine encrypted file extension (base64-derived from Machine GUID).
- Custom wallpaper with ransom message, encrypted file icon association.
- TOR-based decryption portal with unique victim IDs. API callback reporting.
- Password-protected builds. VM-specific kill (named VMs, snapshots). ESXi host targeting.
- System Characteristic Parallel Thread Detection for best possible optimization for the system to prevent crashes and fastest possible finish.
Contact us!!!
-------------------------
- TOX: FD9FDB7C69D7CC1C0BDB85676E33D5508BB5445D51836D4CF03DF3934C79550CFC671687B5EB
Visit us at:
-------------------------
- TOR URL: http://uulyfnw6cqrpuehjnd6xf5cwfh5uo3tmv...ayd.onion/