BlackByte (G1043) | Threat Actor Index

About BlackByte

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.

View MITRE record ↗

Techniques by Tactic (48)

Resource Development

T1583.003 Virtual Private ServerT1608.001 Upload Malware

Initial Access

T1078 Valid AccountsT1078.002 Domain AccountsT1190 Exploit Public-Facing Application

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1569.002 Service Execution

Persistence

T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain AccountsT1112 Modify RegistryT1136.002 Domain AccountT1505.003 Web ShellT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled TaskT1055 Process InjectionT1055.012 Process HollowingT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.002 Domain AccountsT1134.003 Make and Impersonate TokenT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder