Loading threat actor…
BlackByte is a ransomware threat actor and malware family associated with enterprise intrusions involving data theft and file encryption. The group is known for operating ransomware variants including BlackByte NT, and reporting has also noted possible links between BlackByte and activity labeled as Everest, although that relationship has been assessed only with medium confidence and is not fully resolved. BlackByte has been referred to as BlackByte Ransomware Gang. Observed BlackByte tradecraft includes anti-debugging and defense-evasion measures, use of native Windows commands, and ransomware execution workflows designed to hinder analysis and accelerate encryption. BlackByte NT has been documented performing anti-debug checks through the Windows Process Environment Block and dynamically resolving functions from core system libraries. Related intrusion activity attributed or linked to BlackByte has involved credential dumping from LSASS, collection of Active Directory database material, network discovery and scanning, use of Cobalt Strike for command and control, deployment of remote access tools for persistence, lateral movement through compromised legitimate accounts and Remote Desktop Protocol, archival of victim data prior to theft, deletion of tooling and artifacts to reduce forensic visibility, and double-extortion operations combining exfiltration with encryption. The actor’s operations are consistent with financially motivated ransomware activity rather than espionage. Publicly documented behavior shows emphasis on post-compromise expansion inside Windows enterprise environments, credential access, reconnaissance, persistence through remote administration software and services, exfiltration, and impact through ransomware encryption.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BlackByte Ransomware Gang is known for ransomware attacks, using anti-debugging, system information discovery, and advanced process techniques to evade detection and encrypt files.
Referenced as the likely codebase/family attribution for the recovered 'Everest' ransomware sample (C# variant), suggesting either code reuse by another actor or Black-Byte reusing an older variant; no distinct intrusion details beyond this linkage are provided.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.