MalwareUsed by 1 actor

BlackByte Ransomware

BlackByte Ransomware is a Windows ransomware family associated with the BlackByte threat group. It is distributed through a JavaScript launcher and supports deployment across compromised networks. It discovers connected network shares, queries Active Directory for remote hostnames, transfers ransomware payloads through mapped SMB shares, and creates scheduled tasks to execute those payloads remotely. It also enables the legacy SMBv1 protocol during execution.

Before full execution, BlackByte identifies installed security products, checks the system language, and enumerates Windows Registry settings associated with application execution options. It uses a hard-coded mutex to prevent simultaneous instances and terminates when the mutex already exists or the system language matches an exclusion list. To impair defenses, it adds JavaScript and executable file extensions to Microsoft Defender exclusions and terminates and removes the Raccine anti-ransomware utility. It also modifies the Windows Registry to prevent system recovery.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BlackByte

BlackByte Ransomware looks for security software products prior to full execution.

via mitre attack websiteattack.mitre.org

MITRE ATT&CK

Techniques & procedures

27 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

The BlackByte gang often uses phishing and/or vulnerable unpatched applications or services like vulnerable versions of SonicWall VPN or the ProxyShell vulnerability in Microsoft Exchange servers to gain access to the victim's network.

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks

T1053.005Scheduled TaskEvidence2

T1059.007JavaScriptEvidence2

T1106Native APIEvidence2

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks

T1053.005Scheduled TaskEvidence2

T1112Modify RegistryEvidence2

T1136Create AccountEvidence1

It seems to be that executing the actual ransomware is the last step once they are done with lateral movement and make themselves persistent in the network by adding additional admin accounts.

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks

T1053.005Scheduled TaskEvidence2

T1055Process InjectionEvidence1

Process injection has been observed on processes it creates.

Stealth

5 techniques

T1027.013Encrypted/Encoded FileEvidence2

T1055Process InjectionEvidence1

Process injection has been observed on processes it creates.

T1140Deobfuscate/Decode Files or InformationEvidence2

T1480Execution GuardrailsEvidence2

T1497.001System ChecksEvidence2

Defense Impairment

4 techniques

T1112Modify RegistryEvidence2

T1222.001Windows PermissionsEvidence2

T1685Disable or Modify ToolsEvidence2

T1689Downgrade AttackEvidence3

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.

Discovery

7 techniques

T1012Query RegistryEvidence2

T1046Network Service DiscoveryEvidence2

T1082System Information DiscoveryEvidence2

T1135Network Share DiscoveryEvidence2

T1497.001System ChecksEvidence2

T1518.001Security Software DiscoveryEvidence3

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

T1614.001System Language DiscoveryEvidence2

Lateral Movement

3 techniques

T1021Remote ServicesEvidence1

In most incidents, they like to use the AnyDesk remote management software to control victim machines.

T1021.002SMB/Windows Admin SharesEvidence2

T1570Lateral Tool TransferEvidence2

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Previous versions of BlackByte ransomware downloaded a .png file from IP addresses 185.93.6.31 and 45.9.148.114 prior to encryption.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

T1490Inhibit System RecoveryEvidence2

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

mitre attack websiteNews

Oct 8, 2021

Downgrade Attack, Technique T1689 - Enterprise | MITRE ATT&CK®

Ransomware cited as an example of downgrade attacks because it enables the legacy SMBv1 protocol during execution.

mitre attack websiteNews

Nov 19, 2019

Scheduled Task/Job: Scheduled Task, Sub-technique T1053.005 - Enterprise | MITRE ATT&CK®

Ransomware that uses scheduled tasks to execute remotely deployed payloads.

mitre attack websiteNews

Mar 7, 2018

Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise | MITRE ATT&CK®

Ransomware that checks for installed security software before full execution.

mitre attack websiteNews

Jun 1, 2017

Network Service Discovery, Technique T1046 - Enterprise | MITRE ATT&CK®

Ransomware that identifies remote systems through Active Directory hostname queries before launching remote ransomware payloads.

+11 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping27

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BlackByte Ransomware