Cartel Ransomware

Cartel Ransomware, also referenced as CartelCorp, is an emerging ransomware/extortion identity whose strongest current intelligence value comes from its explicit alliance with BLACKNET-00, the ransomware brand associated with Infrastructure Destruction Squad. Actor-controlled messaging presented the relationship under the compound designation CCBN00 and published separate CartelCorp and BLACKNET-00 communication identifiers.

The alliance is described by the actors as “cartelcorp x blacknet00 alliance — Ransomware and extortion programs — One hand”. Collection context also identifies RANSOM-NOTE-CCBN00.txt as an apparent joint ransom-note artifact and t.me/ccbn00 as a joint collection pivot. These elements materially strengthen evidence that CCBN00 is being used beyond a casual greeting, but they still do not prove that the two actors share one encryptor, builder, affiliate pool, backend, wallet set or negotiation system.

On 2026-09-10, independent monitoring recorded the alliance claiming a breach involving Algeria's Ministry of National Defence. That claim is operationally significant because it represents a named public-sector target under the joint identity, but it remains an attacker assertion rather than independently confirmed compromise.

INFERENCE (confidence: medium): CartelCorp is moving from an emerging standalone ransomware label toward a coalition-enabled extortion identity in which CCBN00 provides shared branding and possibly coordinated publication. Technical maturity of CartelCorp itself remains low-confidence.