BLACKNET-00’s “Infrastructure Killer” Toolkit Is Mostly Broken, Researchers Find
For months, the group calling itself BLACKNET-00 marketed itself almost as a turnkey cyberweapon supplier, capable of attacking factories, power plants, and water supply systems. After examining actual samples of its tools, researchers discovered that most of this fearsome arsenal exists primarily as an attractive interface. Several buttons do nothing at all, its advertised “AES-256” encryption turned out to be primitive XOR, and its tool for stopping and starting industrial controllers sends the exact same command for both actions. Even so, researchers caution against dismissing BLACKNET-00 entirely – several components genuinely function and could prove useful to less experienced attackers.
A Detailed Breakdown From Ransom-ISAC
On August 19, the Ransom-ISAC team, working alongside Barricade Cyber Solutions and Crystal Intelligence, published a detailed technical breakdown of the group’s operations. Researchers examined the group’s three core tools: the BLACKNET-00 ransomware builder, the Shadow Ghost cloud database scanner, and the TRK-25 toolkit for industrial systems. The overall verdict proved fairly humiliating for the group’s developers. BLACKNET-00 relies heavily on marketing, demonstrates a modest technical skill level, and regularly promises capabilities its code simply does not contain. That said, several genuinely functional components still earned a medium risk rating.
Who Is Infrastructure Destruction Squad?
Infrastructure Destruction Squad first appeared no later than summer 2025 and blends political rhetoric with ordinary commercial cybercrime. Members have sold access to compromised organizations, malware, and tools for locating industrial systems. The group claims Chinese origin, publishes materials in Chinese, and asserts its core members are based in China – though no independent confirmation of this attribution exists. One prominent operator uses the alias @blacknetransom and regularly styles profiles with references to Billie Eilish. Researchers consider such details useful for linking accounts together, but not proof of anyone’s nationality or true identity.
From $2,000 to $300: The Business Model Behind the Ransomware Builder
Earlier analysts at KELA described BLACKNET-00 as a low-cost Ransomware-as-a-Service platform. The ransomware builder was initially offered for around $2,000, later dropping to $300. Buyers were promised a graphical interface, one-click malicious file generation, disabling of Windows defenses, password and crypto wallet theft, operation over Tor, and multiple encryption methods. Ransom-ISAC’s fresh analysis refines this business model: researchers found no evidence of a proper affiliate program with revenue-sharing. BLACKNET-00 instead appears to sell tools and access directly, and the builder itself was ultimately released for free.
The Ransomware Itself Is Real – But Underwhelming
The ransomware produced by the builder proved to be genuinely functional. The malicious file generated by the builder can search for documents, encrypt files, modify Windows system policies, establish autorun persistence, capture screenshots, display a ransom note, and exfiltrate victim information via Telegram. Behind its flashy interface, developers claimed more than 60 features, though researchers found fewer than ten genuinely meaningful groups of capabilities. Seven built-in “stealers” exist only as interface elements, the advertised triple-extortion feature amounts to nothing more than a label, and the statistics tab is entirely empty.
The most comically failed component involves encryption. BLACKNET-00 offers a choice of AES-256, AES-128, Fernet, or a hybrid RSA/AES scheme – but the selection has no bearing whatsoever on the resulting malware. Every file is transformed using a repeating 32-character XOR key. Worse still, the ransomware writes its own decryption key in plaintext directly into a file named READ_ME_BLACKNET.txt on the victim’s desktop. A copy of the key may also be sent to the attackers via Telegram. Ransom-ISAC built a universal decryptor and, in a controlled test, successfully recovered all 277 test files even without prior knowledge of the key, using statistical analysis alone. This result applies to the specific BLACKNET-00 version examined and offers no guarantee of decryption success against possible future updates.
Shadow Ghost: The One Genuinely Useful Tool
The second tool, Shadow Ghost, proved considerably more capable. The program searches for misconfigured Firebase projects, checking Firebase Storage, Firestore, and the Realtime Database for anonymous read access. Shadow Ghost extracts Firebase configuration parameters directly from a site’s HTML and JavaScript, then automatically checks the corresponding cloud storage buckets. The tool exploits no unknown Firebase vulnerability – it simply automates the search for projects whose owners left overly permissive access rules in place. As a result, Shadow Ghost’s functional component could genuinely help criminals locate open databases containing user accounts, telemetry, files, and internal application data.
TRK-25 “Advanced SCADA”: A Broken Shell With a Working Core
The loudest part of BLACKNET-00’s arsenal centers on TRK-25 Advanced SCADA, which the group marketed as a tool for breaching and disabling industrial infrastructure. The file Ransom-ISAC examined is a Python application featuring 13 tabs and an imposing array of buttons targeting SCADA, HMI, and industrial controllers. However, running the provided instance through normal means proves impossible. The source file cuts off mid-line at exactly 102,400 bytes, the program has no main entry point, and more than ten buttons call functions the developers never actually wrote. Roughly 60% of the source code consists purely of interface styling. Researchers found numerous signs the codebase was assembled from generated or copied fragments, including characteristic traces suggesting possible AI assistance – though the exact method of creation cannot be definitively established from source code alone.
Several particularly frightening-sounding features turned out to be pure set dressing. The module for attacking Siemens S7 controllers uses the identical network packet for both the “stop PLC” and “start PLC” commands, meaning at least one command is guaranteed to be wrong. The “memory read” and “code write” functions merely log messages. The VNC password brute-forcer mistakes any ordinary successful TCP connection for successful authentication and never implements the actual VNC authentication protocol. The button for spoofing an industrial HMI screen calls a function that doesn’t exist. The advertised SYN flood establishes ordinary TCP connections instead of a stream of SYN packets, and the Slowloris implementation closes connections too quickly, effectively breaking its own attack.
Inside the Broken Shell: A Working Reconnaissance Scanner
Beneath TRK-25’s broken facade, however, researchers discovered a functional reconnaissance scanner. The program probes dozens of ports associated with Modbus, S7comm, EtherNet/IP, DNP3, OPC UA, BACnet, PROFINET, and IEC 60870-5-104. Based on service responses, TRK-25 attempts to identify equipment from Siemens, Rockwell, Schneider Electric, ABB, Honeywell, Mitsubishi, Omron, and other manufacturers. The code embeds more than 50 industrial product and technology names, including WinCC, FactoryTalk, CompactLogix, TIA Portal, and Ignition. This combination allows the tool to quickly locate internet-exposed SCADA and HMI systems, fingerprint their technology stack, and pass the results along for a subsequent attack.
The source code also contains four hardcoded public /24 network ranges alongside a random-range generator for mass scanning. Researchers have not yet determined whether those four address ranges belong to critical infrastructure operators. The Modbus module appears closer to fully functional, capable of constructing read and write commands for registers and coils – though packet correctness has not been verified against real industrial hardware. Ransom-ISAC estimates that roughly 200 lines of genuinely useful code could be relatively easily extracted from the non-functional interface and integrated into a different tool. TRK-25 is therefore dangerous primarily as a reconnaissance instrument rather than as a ready-made “infrastructure-destroying weapon.”
An Expanding – but Unverified – Portfolio
Meanwhile, BLACKNET-00 continues expanding its offerings. The group advertises DDoS attacks for hire and claims to have breached organizations across the aviation, defense, telecommunications, financial, and utilities sectors. In August, a third-party Telegram channel attributed a DDoS attack against an Indian telecommunications operator to BLACKNET-00. Ransom-ISAC did not receive any DDoS tooling for analysis and could not confirm the claimed attack capacity or even whether the attack actually occurred. Researchers apply the same skepticism to the group’s claims of breaching water utilities, industrial systems, and major corporate networks. BLACKNET-00’s publications frequently include massive scan logs and dramatic threats designed to project an operation far larger and more capable than the available technical evidence supports.
A Peculiar Kind of Threat
BLACKNET-00 ultimately represents an unusual category of threat. It is neither an elite group capable of shutting down power plants at the push of a button, nor a purely fabricated project. Its authors assembled a weak, often outright broken collection of software wrapped around a handful of genuinely functional components, then surrounded the whole package with aggressive marketing. The inexpensive ransomware builder, the automated search for exposed Firebase instances, and the industrial reconnaissance scanner all lower the barrier to entry for less-skilled criminals. BLACKNET-00’s grandiose promises are worth treating with skepticism – but the functional portions of its toolkit already provide enough capability to enable genuinely real-world attacks.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
