BlackShrantac
A double extortion ransomware group first seen in September 2025. Public detail is thin, and how it gets in has not been reliably documented.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.
CYFIRMA describes a Windows ransomware strain with data theft, scheduled-task persistence and Tor and Tox communication, and lists targets in the US, India, Turkey, Peru and Mexico.1 Cyber Daily notes that the group has no about page, so little is known about how it operates.2
The sources we reviewed do not establish a UK link.
With so little published, we would not build detections around this name. Standard ransomware controls and a tested extortion plan are the practical response.
Vulnerabilities
The sources we reviewed do not tie a CVE to this group.
Defences That Matter
Control Remote Tools
- Keep an approved list of remote tools and alert on others.
- Enforce phishing-resistant MFA for VPN, RDP and admin access.
Protect Recovery
- Keep immutable or offline backups that domain admins cannot change, and test restores.
- Segment the network and limit workstation access to servers.
Could You Recover From a Data Theft and Encryption Attack?
We can help you test your backups and tighten remote access.
Sources
- CYFIRMA: Weekly Intelligence Report, 12 December 2025
- Cyber Daily: report on the group's first claimed Australian victim, 22 December 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.