BlackByte
BlackByte is a ransomware family and ransomware-as-a-service (RaaS) variant that has targeted mid-market and larger enterprises. Reported behavior includes encrypting victim files for ransom, compressing data prior to exfiltration, and using double-extortion tradecraft with a custom exfiltration tool called Exbyte. Early versions reportedly used a common encryption key, while later versions used unique keys per victim. BlackByte has staged encryption keys on adversary-operated virtual private servers.
Observed intrusion behavior includes injecting Cobalt Strike into wuauclt.exe and injecting the ransomware into svchost.exe prior to encryption; a newer BlackByte 2.0 variant was also noted injecting into a newly created svchost.exe process before device encryption. BlackByte has used legitimate remote access software such as AnyDesk in victim environments. It has also modified the Windows registry before worming to other machines, including setting LocalAccountTokenFilterPolicy, EnableLinkedConnections, and LongPathsEnabled. Additional reported actions include disabling or modifying the system firewall, resizing and deleting volume shadow copies to inhibit recovery, and masquerading configuration files containing encryption keys as PNG files.
BlackByte has been associated with bring-your-own-vulnerable-driver activity, including abuse of a vulnerable graphics card overclocking driver in a campaign intended to disable security tooling before ransomware deployment. Public reporting and detections referenced in the content include Microsoft Defender detections such as Ransom:Win64/BlackByte.SZ!MTB and Ransom:Win32/BlackByte.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
These events may indicate attempts to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085).
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
Associated Analytic Story BlackByte Ransomware ... Citrix ShareFile RCE CVE-2023-24489 ...
The following analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \" command.
The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902.
The following analytic detects suspicious process access by spoolsv.exe, potentially indicating exploitation of the PrintNightmare vulnerability (CVE-2021-34527).
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BlackByte queried registry values to determine system language settings.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueFurther analysis revealed that Fox Tempest expanded its offerings earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure. Users could upload malware to these systems and receive digitally signed binaries generated through certificates controlled by the group.
Execution
1 technique"...encoded commands in base64-encoded sections concatenated together in PowerShell." / "...decoded via PowerShell." / "...deobfuscated encoded PowerShell commands..."
Persistence
2 techniquesAdversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
Privilege Escalation
4 techniques"Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2"; "inject shellcode into svchost.exe"; "inject a Cobalt Strike beacon into Rundll32.exe"; "VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread"
BYOVD (Bring Your Own Vulnerable Driver) is a class of attack in which threat actors drop known vulnerable drivers on a compromised machine and then exploit the bug(s) to gain kernel-level privileges.
“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
BlackByte Ransomware Registry Changes - CMD ... 1. Elevate Local Privilege by disabling UAC Remote Restrictions
Stealth
5 techniques"...compiled code is obfuscated... prior to delivery..." / "...Base64 obfuscated scripts and commands." / "...distributed as an obfuscated JavaScript launcher file."
During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as .txt files.
Kapeka masquerades as a Microsoft Word Add-In file, with the extension .wll, but is a malicious DLL file.
"Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2"; "inject shellcode into svchost.exe"; "inject a Cobalt Strike beacon into Rundll32.exe"; "VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread"
"vba_macro.exe deletes itself..."; "AcidPour includes a self-delete function where the malware deletes itself from disk after execution"; "APT29 has used SDelete to remove artifacts"; "Operation Wocao... overwriting a file... and then deleting the overwritten file"
Defense Impairment
2 techniquesAdversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Microsoft has announced the disruption of a large-scale malware-signing-as-a-service (MSaaS) operation that exploited its Azure Artifact Signing platform to generate fraudulent code-signing certificates... The group allegedly abused Microsoft's Artifact Signing service to create short-lived digital certificates that allowed malware to appear legitimate to both users and operating systems.
Discovery
1 techniqueMultiple malware families (e.g., Avaddon, Bazar, Clop, Ryuk, REvil, LockBit, Zeus Panda) check OS language/keyboard layout/locale and terminate or alter execution if the system matches excluded languages (commonly Russian/CIS) or does not match desired target languages (e.g., Spanish/Portuguese, Arabic, Persian).
Exfiltration
1 technique“SolarWinds Compromise… APT29 used HTTP for C2 and data exfiltration.” “BeaverTail… HTTP POST to exfiltrate data to C2 infrastructure.” “StealBit can use HTTP to exfiltrate files…” “ThiefQuest uploads files via unencrypted HTTP.”
Impact
2 techniquesПо информации аналитиков, сервис активно использовался операторами шифровальщиков... а также с атаками вымогателей Rhysida, Akira, INC, Qilin и BlackByte. ... что позволяло обходить защитные механизмы Windows и разворачивать в системе вымогатель Rhysida.
Multiple ransomware/wiper families are described as deleting Volume Shadow Copies and other recovery artifacts using built-in Windows tooling (e.g., vssadmin.exe delete shadows /all /quiet, wmic.exe shadowcopy delete, wbadmin.exe delete catalog -quiet) and disabling recovery (e.g., bcdedit /set {default} recoveryenabled no).
Other
1 techniqueIOCs tracked for this family
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
101 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named ransomware family referenced via a Microsoft Defender detection label for the win.exe payload in the first incident.
Named ransomware family referenced in the resource list; the main content discusses vulnerable MSI Afterburner drivers that can be abused to deploy malicious code, but does not provide further BlackByte-specific behavior details.
Ransomware family identified in Microsoft Defender detections tied to Fox Tempest MSaaS enablement analysis.
Named as a ransomware family in the associated analytic story for this detection. The content does not provide further technical detail on the malware itself.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.