In a detailed exploration of the activities of the cybercrime group CARBON SPIDER, the text chronicles their evolution from conducting ransomware campaigns with REvil, to the widely publicized Colonial Pipeline incident involving the Darkside ransomware, and the subsequent emergence of BlackMatter, a ransomware-as-a-service (RaaS) program. Despite the termination of Darkside, attributed to law enforcement intervention, CARBON SPIDER continued its operations, demonstrating resilience and adaptability by developing BlackMatter, which shares significant technical overlaps with Darkside. This persistence underscores the challenges in disrupting cybercriminal operations, driven by the lucrative nature of ransomware attacks. The article highlights how CARBON SPIDER, by leveraging tools like SQL injections and malicious documents, continues to innovate and maintain a presence in the cybercrime landscape, exploiting vulnerabilities across various sectors worldwide.