Threat intelligence / Group

BlackByte

[BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Ransomware](https://attack.mitre.org/software/S1180). [BlackByte](https://attack.mitre.org/groups/G1043) ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as [BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) use more robust encryption mechanisms. [BlackByte](https://attack.mitre.org/groups/G1043) is notable for operations targeting critical infrastructure entities among other targets across North America.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Ransomware](https://attack.mitre.org/software/S1180). [BlackByte](https://attack.mitre.org/groups/G1043) ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as [BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) use more robust encryption mechanisms. [BlackByte](https://attack.mitre.org/groups/G1043) is notable for operations targeting critical infrastructure entities among other targets across North America.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)

56 recorded

Relationships

uses

Tool

uses

to Archive Collected Data

Technique

uses

to Arp

Tool

uses

to BlackByte 2.0 Ransomware

Malware

uses

to BlackByte Ransomware

Malware

uses

to Cobalt Strike

Malware

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Account

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

to Domain Trust Discovery

Technique

uses

Malware

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration Over Web Service

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

to Internal Defacement

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Make and Impersonate Token

Technique

uses

to Masquerade File Type

Technique

uses

Tool

uses

to Modify Registry

Technique

uses

to Network Service Discovery

Technique

uses

to Network Share Discovery

Technique

uses

to OS Credential Dumping

Technique

uses

Technique

uses

to Process Hollowing

Technique

uses

to Process Injection

Technique

uses

Tool

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Access Tools

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote System Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Service Execution

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Upload Malware

Technique

uses

to Valid Accounts

Technique

uses

to Virtual Private Server

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

7 external

References

mitre-attack

G1043

Hecamede

—

Picus BlackByte 2022

https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure

Cisco BlackByte 2024

https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/

Microsoft BlackByte 2023

https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/

Symantec BlackByte 2022

https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware

FBI BlackByte 2022

https://www.ic3.gov/CSA/2022/220211.pdf