Loading malware…
BlackByte is a Windows ransomware family associated with financially motivated intrusion activity and known for combining encryption with broad internal propagation and pre-encryption environment checks. It performs defensive discovery before full execution by identifying installed security products, and it uses defense-evasion measures including adding Microsoft Defender exclusions and removing anti-ransomware protections. BlackByte also queries system language settings and may terminate on systems configured for Russian or other former Soviet republic locales, reflecting geofencing logic commonly seen in ransomware operations.
Within victim environments, BlackByte conducts internal reconnaissance by querying Active Directory for hostnames, identifying connected network shares, and enumerating network services. It has used SMB-accessible shared folders to transfer ransomware payloads and creates scheduled tasks to execute remotely deployed payloads, supporting lateral movement and coordinated encryption across multiple systems. The malware also enumerates portions of the Windows Registry, including Image File Execution Options, and modifies the Registry to inhibit system recovery and support execution or evasion objectives.
BlackByte includes execution guardrails such as creating a hard-coded mutex to prevent duplicate execution on the same host. Reported delivery includes distribution as a JavaScript launcher, indicating an execution chain in which a script-based component starts the ransomware payload. The observed behavior profile is consistent with enterprise-targeting ransomware operations that prioritize rapid network-wide impact, evasion of endpoint defenses, and disruption of recovery options.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BlackByte Ransomware looks for security software products prior to full execution.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack usually starts with a network entry point, either a previously compromised host or a software vulnerability which is exploitable from the network.
Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Observed Commands: cmd.exe /c powershell -command "$x = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(...
Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The attack usually starts with a network entry point, either a previously compromised host or a software vulnerability which is exploitable from the network.
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The base64 encoded string in the following command... Decodes to: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
It then tries to disable Florian Roth's Raccine ransomware protection tool and a few other commands mentioned in the FBI document.
The attack usually starts with a network entry point, either a previously compromised host or a software vulnerability which is exploitable from the network.
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
%AppData%\dummy This file is a text file containing a list of machine names that can be reached on the network.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
BlackByte is a Ransomware as a Service (RaaS) group that encrypts files on compromised Windows host systems, including physical and virtual servers.
The following analytic detects multiple attempts to stop or delete services on a system using net.exe, sc.exe, or net1.exe . It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window.
Decodes to: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}
Examples include 'Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools', 'BlackByte disabled security tools such as Windows Defender', 'Scattered Spider has uninstalled and disabled security tools', and many malware families terminating AV/EDR processes or services.
BlackByte Ransomware 'adds .JS and .EXE extensions to the Microsoft Defender exclusion list'; PureCrypter 'executed Set-MpPreference -ExclusionPath'; QakBot 'modify the Registry to add its binaries to the Windows Defender exclusion list'; Raspberry Robin 'add an exception to Microsoft Defender that excludes the entire main drive'; StrongPity 'add directories used by the malware to the Windows Defender exclusions list'; XLoader 'can add the path of its executable to the Microsoft Defender exclusion list'; ZIPLINE 'can add itself to the exclusion list for the Ivanti Connect Secure Integrity Checker Tool.'
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware that uses scheduled tasks to execute remotely deployed payloads.
Ransomware that checks for installed security software before full execution.
Ransomware that identifies remote systems through Active Directory hostname queries before launching remote ransomware payloads.
Ransomware that disables or bypasses security controls by adding exclusions to Microsoft Defender and removing anti-ransomware tools.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.