BlackByteThreat actor
- hecamede
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms.From MITRE ATT&CK
Last reported 16 days ago, by Cisco Talos2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“From our limited aperture, one initial access vector used by the threat group appears to be via Remote Desktop Protocol (RDP)”
- T1055Process Injection
“…ting files, the ransomware executable launches the legitimate svchost.exe, albeit with a distinctive command line, perhaps through process injection: either -a or -s and the unique identifier provided when the ransomware executable was launched.”
- T1543.003Windows Service
“The legitimate Windows process svchost.exe runs multiple Windows services; however, threat actors can misuse it to disguise their commands.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware“…Intel Ethernet diagnostics driver and the Bring-Your-Own-Vulnerable-Driver (BYOVD) target (CVE-2015-2291), abused by Scattered Spider, BlackByte, and Lazarus Group to disable EDR from kernel space.”
-
Getting to the Crux (Ransomware) of the Matter“Threat actors behind the Crux incidents claim that the ransomware variant is “a part of the BlackByte group,” as shown in Figure 1.”
Indicators in its reports
named in the reports above- c96d5a279c660bfa…7cb8e971e88bin 1 report
- 667b7220f5df1b31…a7a7c6635932in 1 report
- b45e6cce412d9968…4a0b1f72e3e4in 1 report
- f8f5e0440c57c7de…96a379188a7din 1 report
- 34098fe0bc4c69c4…4c28c113b5c3in 1 report
- 389066bd5543aeea…9f594cf48ecfin 1 report
- 5f60d16fa67ff8ef…5c56e076e259in 1 report
- a0294f7152f9c4c9…949f26a15cc8in 1 report
- c17bf76d02163863…5e0469ca269fin 1 report
- 2aa7f13bf474e2ce…65255241c937in 1 report
- bacb5794a300f7a8…afe8588fc33fin 1 report
- 2e3e1bcd44cc3cbe…9b5f7e1ae6abin 1 report
- a42632c68d2dcea0…d2774eacf433in 1 report
- 7dd3747d777f9576…ac41479d199ain 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.