BlackByte
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.
- ATT&CK ID
- G1043
- Techniques
- 44
- Tools
- 8
Also tracked as Hecamede
Vulnerabilities it has exploited
Techniques
Resource Development
Acquire InfrastructureStage Capabilities
Initial Access
Valid AccountsExploit Public-Facing Application
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterSystem Services
Persistence
Scheduled Task/JobValid AccountsModify RegistryCreate AccountServer Software ComponentCreate or Modify System ProcessBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionExploitation for Privilege EscalationValid AccountsAccess Token ManipulationCreate or Modify System ProcessBoot or Logon Autostart Execution
Stealth
MasqueradingProcess InjectionIndicator RemovalValid AccountsAccess Token ManipulationDeobfuscate/Decode Files or InformationExecution Guardrails
Defense Impairment
Modify RegistryDisable or Modify ToolsDisable or Modify System Firewall
Credential Access
Discovery
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoverySystem Information DiscoveryAccount DiscoveryNetwork Share DiscoveryDomain Trust DiscoverySoftware DiscoverySystem Location Discovery
Lateral Movement
Remote ServicesLateral Tool Transfer
Collection
Command and Control
Application Layer ProtocolIngress Tool TransferRemote Access Tools
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Web Service
Impact
Data Encrypted for ImpactInhibit System RecoveryDefacement
Software
AdFind · Arp · BlackByte 2.0 Ransomware · BlackByte Ransomware · Cobalt Strike · Exbyte · Mimikatz · PsExec