MITRE ATT&CKgroup
G1043 BlackByte
- Domain
- enterprise
- Aliases
- Hecamede
- Version
- 1.0
- Created
- 2024-12-16
Description
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.
Related
Uses · MITRE ATT&CK (56)
- T1685 Disable or Modify Tools technique
- T1686 Disable or Modify System Firewall technique
- S1179 Exbyte software (malware)
- S1180 BlackByte Ransomware software (malware)
- S1181 BlackByte 2.0 Ransomware software (malware)
- T1036.008 Masquerade File Type sub-technique
- T1614.001 System Language Discovery sub-technique
- T1608.001 Upload Malware sub-technique
- S0552 AdFind software (tool)
- T1583.003 Virtual Private Server sub-technique
- T1071.001 Web Protocols sub-technique
- T1078.002 Domain Accounts sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567 Exfiltration Over Web Service technique
- T1087.002 Domain Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1491.001 Internal Defacement sub-technique
- T1560 Archive Collected Data technique
- T1134.003 Make and Impersonate Token sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1070.004 File Deletion sub-technique
- T1136.002 Domain Account sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1055.012 Process Hollowing sub-technique
- T1505.003 Web Shell sub-technique
References
- https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure Picus BlackByte 2022
- https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/ Cisco BlackByte 2024
- https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ Microsoft BlackByte 2023
- https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware Symantec BlackByte 2022
- https://www.ic3.gov/CSA/2022/220211.pdf FBI BlackByte 2022