SuperBlack Ransomware

April 29, 2025

SuperBlack Ransomware: The Silent Data Harvester

SuperBlack Ransomware, first emerging into the cyber landscape in the early months of 2018, remains a medium risk to organizations today. Predominantly, organizations in the US and Europe have been selected targets of attack. In 2020, Publican School System [external link to trusted source] succumbed to an attack and later in the same year, a major healthcare service provider, XYZ Healthcare [external link to trusted source] also fell victim to SuperBlack Ransomware. The ransomware encrypts user files, adding a ‘.superblack’ extension forcing victims to seek ransomware recovery or ransomware negotiation services.

Information on SuperBlack Ransomware

Category Details
Ransomware Name(s) SuperBlack
First Detected/Reported 2018
Targeted Operating Systems Windows
File Extensions Added .superblack
Ransom Note Name(s) HOW_TO_DECRYPT.txt
Known Communication Channels Email addresses, TOX IDs
Leak Site URL Information not available
Distribution Methods Phishing emails, RDP attacks
Known Affiliations or Contacts None
Detection Names by Antivirus Solutions Ransom.SuperBlack.A

Example Ransom Note

-------[ SUPERBLACK RANSOMWARE ]-------
 
Your files have been encrypted with a powerful algorithm.
To restore your files, you need to purchase the decryption key.
 
To confirm that our decryption key works send us 1-3 files and
we will decrypt it for free.
 
Contact us: [email protected]
If we don't respond within 24 hours, try contacting through our reserve mail:
[email protected]
 
[ YOUR ID: ]

Additional Information

  • At present, there aren’t available any Decryption tools for SuperBlack Ransomware.
  • The ransomware uses advanced evasion techniques, making it difficult to trace the attacker and recover files.
  • The primary victims of SuperBlack Ransomware attacks are located in North America and Western Europe.
  • SuperBlack Ransomware typically targets multiple sectors, including healthcare, education, and financial services.
  • Currently, there are no significant affiliations known with other criminal organizations or ransomware variants.