BlackByte

Overview

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 48 techniques across 14 tactics

Tools & malware (8)

AdFind · BlackByte Ransomware · Exbyte · Arp · BlackByte 2.0 Ransomware · PsExec · Cobalt Strike · Mimikatz

Reporting (3)

• BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks — James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans
• The five-day job: A BlackByte ransomware intrusion case study — Microsoft Incident Response
• Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool — Symantec Threat Hunter Team